is this player legit ?

What is Moss ? Forums General is this player legit ?

Viewing 5 posts - 1 through 5 (of 5 total)
  • Author
    Posts
  • #5097
    mosscheck90
    Participant

    player was suspicious and seemed like using some kind of wall can you check please

    His log :

    SHAS2 mode started at 2020-01-20 17:20:44 for Crossfire on x64
    ping:66ms
    update 6
    DirectX version is 12.0( )
    OS is 10.0 64 bit
    Real OS Microsoft Windows 10 Pro
    memory: 8010 MB
    version: MOSS 5,0,0,0
    Physical: Dell Inc.OptiPlex 30700HMX8DF3WY8Z2
    Sign ID1: 21211093 ID2: 1792745295
    User: DELL@NOTHING
    drives: WDC WD10EZEX-75WN4A0 serial:
    Net: E454E8B179A7 /192.168.1.2 Public:
    41.44.8.xxx
    Video: NVIDIA GeForce GT 1030 driver: 26.21.14.3200
    Intel(R) UHD Graphics 630 driver: 25.20.100.6617

    (Standard monitor types) SAM SyncMaster serial: H9MZ501598EF22

    processor BIOS details 3000 MHz by 30.00*100. Intel(R) Core(TM) i5-9500 CPU @ 3.00GHz
    Directx11
    SHAS2: aa52b2d3dd4b9b47ff4496c0460bdedda791354018cf0782b899ef28acee8d21 process: C:\Windows\System32\lsass.exe
    SHAS2: a2c9b9737235ecea78d184f302a4d35c518482b8b584c371ba3cd84bc1b2ae8a process: C:\Windows\System32\fontdrvhost.exe
    SHAS2: a35da5cab574f799c0a9f51cae98b152993f7bb5bdb1669e8973547658d1843d process: C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
    SHAS2: 85ee3ec80da8c7b0e93c8640ef629034afaeb7aeeda636ffa71cbb5d7416247e process: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_9de8154b682af864\igfxCUIService.exe
    Monitor Started at 2020-01-20 17:20:50
    SHAS2: 13b3e4725f07a2371b7b45bb3e53ed14438abc38ced045d50bff3dc840680c59 process: C:\Windows\System32\spoolsv.exe
    SHAS2: f07e5ba7feeb9a18810d72e6a3a9b769c5a3d88064d71f92784fc8ea0f22491a process: C:\Windows\System32\dasHost.exe
    SHAS2: d0657b15f65f9103fc5ddd64a74b77f5769052d60133ec337b98568ce85177db process: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_d50a9ee200dedae0\IntelCpHDCPSvc.exe

    ping:65ms
    SHAS2: 249297338e00f037edea7e8442547ff87ce5d3916c42291be094ff7f164ecc95 process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
    SHAS2: 58333f056fc082957340a800e3196f4ee7a56d253c66ed0f78572fe496d6fc57 process: C:\Program Files\McAfee\WebAdvisor\servicehost.exe
    SHAS2: ca77e90b5e5afa67c64e6fd9a0e8a46f9d7edfad55e50e9b47fe724351af4271 process: C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
    SHAS2: a3cd21ca15f359a3bec6d659372e303c21ef1a290f3b7dc18d6452c89bddf700 process: C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
    SHAS2: deb7ec956832359f2cd0994fad2779c7491af446693c3a533ed68a73c0c2358b process: C:\Windows\System32\RtkAudUService64.exe
    SHAS2: 6bcb65c4d1e83e1b9784f03695f148854f91df9f568e0bc006336e8d5fc25203 process: C:\Windows\System32\DriverStore\FileRepository\wavesapo8de.inf_amd64_7c85c995bf1fb3d8\WavesSysSvc64.exe
    SHAS2: 0c7aa51bd8e49b36a166204a3bc85d93e763d160d8f1d33e1c03f2cf9b73ce8d process: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_d50a9ee200dedae0\IntelCpHeciSvc.exe
    SHAS2: a75c85f3b089993e9c042fb82ecb7757e8f460ed8065fc7991caa38a6de0f50c process: C:\Windows\System32\wbem\WmiPrvSE.exe
    SHAS2: a75c85f3b089993e9c042fb82ecb7757e8f460ed8065fc7991caa38a6de0f50c process: C:\Windows\System32\wbem\WmiPrvSE.exe
    SHAS2: 1f406f9b4d8b1098465a091e3683e27bff73906f08436924279a8eb8ad475dcf process: C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    SHAS2: 6a8f00c4bf7ce696edeba9e6c401ff9dd7eb59f34af25d7eee591b4837d67c7c process: C:\Windows\System32\dllhost.exe
    SHAS2: 2b86944d444e8b59a226be3045fee13a310bddc1a3cd206b578428b7b612e17b process: C:\Windows\System32\SearchIndexer.exe
    SHAS2: a1126edaa3bb370f652be6769bb9906b53997ea5c6d592d101127debced554dd process: C:\Program Files (x86)\Google\Update\1.3.35.422\GoogleCrashHandler.exe
    SHAS2: 6e33239c65f6162a84bbbaa6976fc989947a3fb348622f8de733c05c188a0b07 process: C:\Program Files (x86)\Google\Update\1.3.35.422\GoogleCrashHandler64.exe
    SHAS2: 06dc78b0daef262a066dbef082f1caa075fa91dde34ab3656c694224f0abb717 process: C:\Windows\System32\jhi_service.exe
    SHAS2: 1e6afd77da6df111fe4b8b105bf9005447baa4a038a4042a6abfa16bb9a6a69a process: C:\Windows\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    SHAS2: 5e35444056b6a5ba38c97b0f65cb4597f613048f488b89ac9306415e9dd699aa process: C:\Windows\System32\winlogon.exe
    SHAS2: a2c9b9737235ecea78d184f302a4d35c518482b8b584c371ba3cd84bc1b2ae8a process: C:\Windows\System32\fontdrvhost.exe
    SHAS2: b39d76814ba92435f5dd5bcccd7faabcc814e1c51d92cdaff4fc011f0415812b process: C:\Windows\System32\dwm.exe
    SHAS2: a35da5cab574f799c0a9f51cae98b152993f7bb5bdb1669e8973547658d1843d process: C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
    SHAS2: 71b63d24cc39ce3ebecf061a940bfbd9874cb79640b718d03533e21219e0d3dc process: C:\Program Files\McAfee\WebAdvisor\uihost.exe
    SHAS2: deb7ec956832359f2cd0994fad2779c7491af446693c3a533ed68a73c0c2358b process: C:\Windows\System32\RtkAudUService64.exe
    SHAS2: a0df21d82daa60f8181589f4ce96441891b6e13716f353e9d71c8b303cf398d2 process: C:\Windows\System32\ctfmon.exe
    SHAS2: 069f7b443e6fa1bd7a5a15c25807bb91c8a8662fdb79ca74f7c8d4190d1cf3dd process: C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
    SHAS2: 40a86a19ef9afa0021ca59d08454034e6a6c37d620be583c26e05e1d55d11ca0 process: C:\Windows\System32\sihost.exe
    SHAS2: bf2dd57424661710a5db7eaa5574510179489be9002c964f28f6331546d087bb process: C:\Windows\System32\wbem\unsecapp.exe
    SHAS2: 0bec3128b241fa533dc5a9d3f62aa41323d205defc30dcde228c5ecc2d1e50a9 process: C:\Windows\System32\taskhostw.exe
    SHAS2: 38c3205aea69af8f1e13ecd070a8fea5d39466feeb71ac34c06e0f3a80fbd9b7 process: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_9de8154b682af864\igfxEM.exe
    SHAS2: ed5f36137d09e1cfc0ccf2675fb5d460e7eed135ba36d3259d2c510592047f28 process: C:\Windows\explorer.exe
    SHAS2: cefe2385eb325e15affef9e5e12df5f5b6bf5d1bf2e9826dd7a4f6c219299cea process: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: d5c8579822ecedea4b3580ffd9f1f8d52717e5cfa35d0861f87c19219724defc process: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: e7a09b93beaad191eb34ce335d4a5cc8af439f63d7e0791e6ea88f2d08d93e5b process: C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.55.131.0_x64__kzf8qxf38zg5c\SkypeApp.exe
    SHAS2: 88534ebbd449c73c74ae8fbedf6732ad3e72b3fbdc9ca0e1978af380dbaefcf1 process: C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.55.131.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
    SHAS2: ab7da8511c7698ab10eaf29e0f5597b1616de9325be5124f72fb9eed26a6750e process: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.19122.89.0_x64__8wekyb3d8bbwe\YourPhone.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: d8a22424765f0ea2cad25c0d29e0b2d53a7af799cee1917362ce7e6df3be0574 process: C:\Users\DELL\AppData\Local\Microsoft\OneDrive\OneDrive.exe
    SHAS2: a9eae8b46312e0ceac527cf6452d1dce9eb047a4f82b785db2000cc9781e64fd process: C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: 8828a82f797ba822b7fc1234f15104292c95c247c16fcb1ad509d2ba649c62a8 process: C:\Program Files\WindowsApps\Microsoft.WindowsStore_12001.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe
    SHAS2: 71a1ca978834c0ddbab05e3987cb4bd6cc2783f9e05b3d00c8fcd333349528ac process: C:\Windows\System32\ApplicationFrameHost.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: fa15fcbfad60834f5a2228d1e047b067261cc562de67ce7b73a639b500247c4e process: C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 11064e9edc605bd5b0c0a505538a0d5fd7de53883af342f091687cae8628acd0 process: C:\Windows\System32\rundll32.exe
    SHAS2: d0dc767f12b002714793d8aed9a7f1f88b53069b54c0dd5e91c568b7d04dc044 process: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: 6a8f00c4bf7ce696edeba9e6c401ff9dd7eb59f34af25d7eee591b4837d67c7c process: C:\Windows\System32\dllhost.exe
    SHAS2: 24620854dcff1d723d61288d830bfdc6c8025c10fb6fb2ae5e27edf046b142e9 process: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19101.10711.0_x64__8wekyb3d8bbwe\Music.UI.exe
    SHAS2: 52eb4725d41caf93446ef20b8a6098bc6da8645b4e03f8261e40252391a45668 process: C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_3.36.6003.0_x64__8wekyb3d8bbwe\GameBar.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: 94849c65d9cb53e81df9bc0d34dac709102cc6264b1c3dd30d7c70dbf9d55443 process: C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_3.36.6003.0_x64__8wekyb3d8bbwe\GameBarFT.exe
    SHAS2: 05935dfaa5459a65103c82debf5e9289e6c896900aa49aa1cc6f6a5874df5c8f process: C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19081.22010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: 3f98c20df58d1dfc6ea01d42f890131ee5dc4efd0afedebb519036c5184c5390 process: C:\Windows\System32\SecurityHealthHost.exe
    SHAS2: 2c2e39cac9f06a6ff821e3ad1f6302c8dd17d5971a7cb1260f47bdc7a5bc7861 process: C:\Windows\System32\SearchProtocolHost.exe
    SHAS2: 111219e1022dcab31864c35de32baf34ce34fa580e2505d91ed1e3430ddfc340 process: C:\Windows\System32\smartscreen.exe
    SHAS2: 7998c9b6bda4cadf5106527cdcaee29a97fb2214c3df8c9da865525855c131fc process: C:\Windows\System32\audiodg.exe
    SHAS2: eabb8224da67c83011d77defcd83fa9765ba54c34223460fe25d4e7c2799b972 process: C:\Windows\SystemApps\InputApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe
    SHAS2: 8165f531d4e6e2827b9f45bfeddb8a7c45e11211d813c70b8243857110b69225 process: C:\Windows\System32\SearchFilterHost.exe
    SHAS2: 03e468f13a554b5ffe7b7efb698913e6714f11c8ba810f29ab2ca8370c431b94 process: E:\Moss\Moss.exe
    *(Mon 1) DX11(211) : Each 120 at 2020-01-20 17:20:55 file: 001.JPG- Zip CRC: f2066c8f8a09a73c915604a5e2e74aae8d784a420bd4ec32943dbdf384e4c4f7
    ping:66ms
    SHAS2: 03e468f13a554b5ffe7b7efb698913e6714f11c8ba810f29ab2ca8370c431b94 process: E:\Moss\Moss.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 6a8f00c4bf7ce696edeba9e6c401ff9dd7eb59f34af25d7eee591b4837d67c7c process: C:\Windows\System32\dllhost.exe
    SHAS2: 74b3323405cdfb85cfc9d5c1cd29c816c80361df154801e44f14863c9058906e process: C:\Windows\System32\backgroundTaskHost.exe
    SHAS2: 520273402f22ada8948f8e1cb0899d0a5b1bc01cff787747c1227945b336e4c5 process: C:\Windows\servicing\TrustedInstaller.exe
    SHAS2: 2fe11e5d9825166de3bfd8f53f8c9db838c3a33910d58eacabb020da32ac1b87 process: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.18362.590_none_5efc551459114cb9\TiWorker.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: 0d93219accd32f8b453a778eae6aeeb6e8c8863602bf117bd7d23f8a3c44cdf3 process: D:\Games\CrossfireWest\CrossFire\patcher_cf.exe
    SHAS2: 3a85065ad9624e3924c5df342ae21528402cb932603e4d88e8abdc0d6d5a7442 process: D:\Games\CrossfireWest\CrossFire\HGWC.exe
    SHAS2: 3a85065ad9624e3924c5df342ae21528402cb932603e4d88e8abdc0d6d5a7442 process: D:\Games\CrossfireWest\CrossFire\HGWC.exe
    SHAS2: 6a8f00c4bf7ce696edeba9e6c401ff9dd7eb59f34af25d7eee591b4837d67c7c process: C:\Windows\System32\dllhost.exe
    (7472) D:\Games\CrossfireWest\CrossFire\crossfire.exe SHAS2: 3a1d474154cd5ec5156baf044d19e7d1e87692692f6d06d2fd0727a0fb170bd6

    FileCheck for D:\Games\CrossfireWest\CrossFire at 2020-01-20 17:20:53:
    captured: C:\Users\DELL\Documents\Cross Fire\System.dat file: System.dat.001- Zip CRC: f9f650fc3e80788cb9e375c1d703467b88ed9ec905152a7a37479cd6c2280186
    captured: C:\Users\DELL\Documents\Cross Fire\System.dat file: System.dat.001- Zip CRC: f9f650fc3e80788cb9e375c1d703467b88ed9ec905152a7a37479cd6c2280186
    captured: C:\Users\DELL\Documents\Cross Fire\System.ini file: System.ini.002- Zip CRC: ce946c41fbacfb5dfb0b8f7fb5537efa5cc672ebf3a0ee290fcee8ae1fc50225
    captured: C:\Users\DELL\Documents\Cross Fire\System.ini file: System.ini.002- Zip CRC: ce946c41fbacfb5dfb0b8f7fb5537efa5cc672ebf3a0ee290fcee8ae1fc50225
    *(Mon 1) DX11(976) : Each 120 at 2020-01-20 17:21:23 file: 002.JPG- Zip CRC: f2066c8f8a09a73c915604a5e2e74aae8d784a420bd4ec32943dbdf384e4c4f7
    ping:65ms
    SHAS2: 3a1d474154cd5ec5156baf044d19e7d1e87692692f6d06d2fd0727a0fb170bd6 process: D:\Games\CrossfireWest\CrossFire\crossfire.exe
    in GAME SHAS2: 3a1d474154cd5ec5156baf044d19e7d1e87692692f6d06d2fd0727a0fb170bd6 process: D:\Games\CrossfireWest\CrossFire\crossfire.exe
    in GAME SHAS2: 2cf67e1cc1e6f43637fda35315ffe16b2ca140bcba149944d5e4b8ecc49391b1 process: C:\Windows\SYSTEM32\ntdll.dll
    in GAME SHAS2: 886398c7eff951e2b9f81b7891b67e7021bf092704bd7f6b292b7125fbf1ea7b process: C:\Windows\System32\KERNELBASE.dll
    in GAME SHAS2: 1e32f6bfd882acc2300f34d9a7d0d574a66075f4bde70088c94954d464380327 process: C:\Windows\SYSTEM32\apphelp.dll
    in GAME SHAS2: e5a863d3f4bfefed7d73a7b1499f81b7235bc9ae3c108065041bcb8e5446b1bb process: C:\Windows\System32\msvcrt.dll
    in GAME SHAS2: d5de7c00a5bd8e766eb1ecaa651687e84a227acdfc110847e3f595342953e29c process: C:\Windows\System32\sechost.dll
    in GAME SHAS2: 97421205d6352d3d77c9601394a46c7f7d9e8f23e03f0bebac6217d3e098ab2b process: C:\Windows\System32\RPCRT4.dll
    in GAME SHAS2: 106c7873db17e4542022245eea148f815ce547c36523861dddb50103c65d8b07 process: C:\Windows\System32\SspiCli.dll
    in GAME SHAS2: ea86d9754164ca2c01b4a7f81188b2490cee1f350e177861a4702c92dfd6d066 process: C:\Windows\System32\CRYPTBASE.dll
    in GAME SHAS2: e07cecb1a2ddf8a7c65bf2ac82ef10e43e97787f501ba2a919706f8778e53af1 process: C:\Windows\System32\bcryptPrimitives.dll
    in GAME SHAS2: 3cda144cfb6278da47267fe1e1fe258716a074c3d3dd8413b259da7da1039871 process: C:\Windows\System32\SHLWAPI.dll
    in GAME SHAS2: 1b7c25913782ba23f31c8b5912854a0244967ec2efd395d66d85a5261e1fb4c2 process: C:\Windows\System32\combase.dll
    in GAME SHAS2: 476a9bbb93f15181bf5c379be141e0518439dff7bb13b35a98698c85f2f092d9 process: C:\Windows\System32\ucrtbase.dll
    in GAME SHAS2: 4fc9460147d5a3aa1f9498863cf10bb7be6099bef1a3d55503164ca51e36e27e process: C:\Windows\System32\GDI32.dll
    in GAME SHAS2: 2d91e8360c2a73acef859d85f7d2b0fd66f09d7c49090ba641f622cadbd63187 process: C:\Windows\System32\win32u.dll
    in GAME SHAS2: 4cd0d70269b3077c43debd38fcefa738be97493a116ab7b15d50869480ecfe12 process: C:\Windows\System32\gdi32full.dll
    in GAME SHAS2: 526c60fda53d5c8ca3905e50884d5cee6f79964408cc1a61fbc4d5a2ba8bc7ab process: C:\Windows\System32\msvcp_win.dll
    in GAME SHAS2: 485dea2adb38ba0b834811ee8cdb0cf9e54ebbf52b1d55e46aec14ed07cace35 process: C:\Windows\System32\USER32.dll
    in GAME SHAS2: 92239750d45a421e92ef640809e8a1d08cbd518938c518e1644ad3456dff37c2 process: C:\Windows\System32\ole32.dll
    in GAME SHAS2: d9b3bb2ac2ce939dd485eddd1184684698a9d7ca2a04f4e79dc32b2e806077e3 process: C:\Windows\System32\advapi32.dll
    in GAME SHAS2: 3cc94e1d1b54b6e3be774c1fb91e5e41840ea8edf8a5991aadf3cda5158d0f76 process: C:\Windows\System32\OLEAUT32.dll
    in GAME SHAS2: ef749596eaf5809ff37c492008a36e85b0e2b6d70d58d7bbd0fb3f1d68ce9961 process: C:\Windows\System32\SHELL32.dll
    in GAME SHAS2: 96a1db38c74a81fba4c4ab29020551364fd1ada3b6fed789d193c787e757979d process: C:\Windows\System32\cfgmgr32.dll
    in GAME SHAS2: 6396191587728ce813053ce10795ad3dc61448a292062c204bd1ef1f2fe751fe process: C:\Windows\System32\shcore.dll
    in GAME SHAS2: 06a4feb0ff348dc5a8951b7f20e5dbf30d733ff2ecf6f204fd55fb8348c99e85 process: C:\Windows\System32\windows.storage.dll
    in GAME SHAS2: bcbb916cfca837df782f5b6b6f98ab9835f1d147794f76d6e21d2fc48d3bc498 process: C:\Windows\System32\profapi.dll
    in GAME SHAS2: 21358ce9a416c7f6db063095102e91f014bdb85b08a4e783e17234792c9b483a process: C:\Windows\System32\powrprof.dll
    in GAME SHAS2: 709b99ba1dfef6d9b2483f37d242b12f29b1e1ade13e338b4d7041c55b55204b process: C:\Windows\System32\UMPDC.dll
    in GAME SHAS2: 42164f81bc8fc2d0a6b71daa492be6a6d4785821aa4fdca27b9273721edb23d9 process: C:\Windows\System32\kernel.appcore.dll
    in GAME SHAS2: f5e118f67745792909973717fae1f9fe68b2619332a4451ad04e0c9072b8d605 process: C:\Windows\System32\cryptsp.dll
    in GAME SHAS2: d95e7d07ea46d7d2aefa01cd0a64cf266be26d40fa6be42f7cf60f6deb8fbaf3 process: C:\Windows\SYSTEM32\UxTheme.dll
    in GAME SHAS2: ad43d686930eae0f57a55ee75d10bd1882747089a291371ffe1e131eb5f76938 process: C:\Windows\SYSTEM32\WINMM.dll
    in GAME SHAS2: b048b7037474926559cbf17bb19f3e7d571a2456823568e6068e50407e471120 process: C:\Windows\SYSTEM32\samcli.dll
    in GAME SHAS2: 6ca0c4b5d524f187d49ae5154589678f63c28e2e6b9b495e4cf8c19c3a9c114a process: C:\Windows\SYSTEM32\MSACM32.dll
    in GAME SHAS2: 41b4d85d84a86e41b948694b9b5f398a0d79f47629d6d969eb5b461d4f5d0347 process: C:\Windows\SYSTEM32\VERSION.dll
    in GAME SHAS2: ba1520dc9d01cd4956d77af9a90d5d998003e9371b7157010f80cf9368b21a54 process: C:\Windows\SYSTEM32\USERENV.dll
    in GAME SHAS2: c1c65f4c88b6e679c029052d4c7693f00de584e6a39c756653aa3a4074ba4264 process: C:\Windows\SYSTEM32\dwmapi.dll
    in GAME SHAS2: 61698de9f76c12373e498afd3280f288f51ab5ff02771adb7ad82069556d1a4f process: C:\Windows\SYSTEM32\urlmon.dll
    in GAME SHAS2: 907a4d1d405283ad24bba1f9a763c5118a33574f3e0ec7fc543f65b24cc0a748 process: C:\Windows\System32\bcrypt.dll
    in GAME SHAS2: 14b0be646d4b5137b39f921ff891e10046c517a930e60efed717dc33f1857e50 process: C:\Windows\SYSTEM32\MPR.dll
    in GAME SHAS2: 948f13fe144cd80f93565ded2ac2e96d000869bb2761538996d28942495cb1d7 process: C:\Windows\SYSTEM32\WINMMBASE.dll
    in GAME SHAS2: 1cb41699b8446ad76fc727062bac46500965ddf868078ff83f08eef7afb1e69d process: C:\Windows\SYSTEM32\iertutil.dll
    in GAME SHAS2: 57c8c718b925c4f16f38d26db49f26039a8ed4589c81a98d7e3f396e3cf8668d process: C:\Windows\SYSTEM32\PROPSYS.dll
    in GAME SHAS2: 8cfc46edeaf21247a0c1776d8c11729d1a8d9ac486c2ee443462c04e486eac6c process: C:\Windows\SYSTEM32\AcLayers.dll
    in GAME SHAS2: f9aa66aa0b302fd79d34447c371816237d8915f371cd53f19744b720b6a03b99 process: C:\Windows\System32\SETUPAPI.dll
    in GAME SHAS2: 186474217b808b3ff2652e3c66b89e2ecfa8f26d3bc724923ab01f266cef49c8 process: C:\Windows\SYSTEM32\sfc.dll
    in GAME SHAS2: 47944a681ef17133f2026f88c9a5d90372924fd4b47d66d29ee7589e2bf2ade6 process: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.592_none_71d995095ae1acb5\comctl32.dll
    in GAME SHAS2: c5e21c18f8c79bc517da59e3192c39ea73bdcaf85867628187f6b3cca07dd21f process: D:\Games\CrossfireWest\CrossFire\d3dx9_29.dll
    in GAME SHAS2: deb9448903a54f6f90ff405ef3684c0fb418624d28d5820eb6848a7393f9bd8a process: C:\Windows\SYSTEM32\DINPUT8.dll
    in GAME SHAS2: 37eec96b80bca9dc9792557d97748e32f286523318ac50a1b47c250548d5d523 process: C:\Windows\SYSTEM32\inputhost.dll
    in GAME SHAS2: 86f31d86e4e6e692e2fd195c0d1b02b3f720688491a330c98e124e55e1fb492a process: C:\Windows\SYSTEM32\CoreMessaging.dll
    in GAME SHAS2: 87da6a2a212a4337a6af538e8270f1beacd0b5feae44225575403d5b741c6dec process: C:\Windows\SYSTEM32\CoreUIComponents.dll
    in GAME SHAS2: aff61347022ea7baa398fc3cca0140c471604bb9a86241dc44f1bbcdc9e227de process: C:\Windows\SYSTEM32\wintypes.dll
    in GAME SHAS2: 2f94628f056fe65ea81351e134e59ece813fec5e8400c12d6dfa49defd126d01 process: C:\Windows\SYSTEM32\ntmarta.dll
    in GAME SHAS2: b41c4cd7a76ddd5975ef5cd56a704ce14559d8c36675de48658036a9df7d77e5 process: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9659_none_d08cfd96442b25cc\MSVCP80.dll
    in GAME SHAS2: f249a9a71d590e087e3935b45e759869afdb4688a74afb797f90ca7ef474fe47 process: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9659_none_d08cfd96442b25cc\MSVCR80.dll
    in GAME SHAS2: cf2647be9233f4a7248514cbd2541d5f7bebd61005bde1dca79c8e4234f53794 process: D:\Games\CrossfireWest\CrossFire\dbghelp.dll
    in GAME SHAS2: 7eba6acf64de45b1091a78f98450f398b58d0fb02be9e6cdf19122f1bec68ebd process: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.18362.592_none_5f58db4d822160d6\gdiplus.dll
    in GAME SHAS2: a5ef6bf81d7b67413e71fabad8b62a248d5ebd4f67df1d3c83e4f9d7407e005d process: C:\Windows\SYSTEM32\WINHTTP.dll
    in GAME SHAS2: e419a4bbdf1d5e0601e90bafc1558dbd7414cd44e098b581c1915ef2c6e38d0b process: C:\Windows\System32\WS2_32.dll
    in GAME SHAS2: b0f5173f6e30ba6463111d8c372b9fdc51e46a8f017165b68499931d1e889ff7 process: D:\Games\CrossfireWest\CrossFire\BugTrap.dll
    in GAME SHAS2: 3fbb9c0ad9eafcf729adff0363f153dd650ac4052daaafa007992a4e07c119d7 process: C:\Windows\SYSTEM32\WININET.dll
    in GAME SHAS2: a3855578776b857a68355f1cae40f51a529fbc08ec3779f4e343d987ea50608e process: C:\Windows\SYSTEM32\pdh.dll
    in GAME SHAS2: c38a72306efe7c9ce52ee68c5ce345030a5301f74028bb0f9d18c2df6eccab29 process: C:\Windows\System32\MSCTF.dll
    in GAME SHAS2: b0fae9e5a6d510c39543a1376ece354a0594b01d83f8b4de4f3927fdd8858132 process: C:\Windows\System32\perfos.dll
    in GAME SHAS2: f0541b07d7b00c8d09bc72df7e2d974f83482e42cd88b4e8260b832b7a71682e process: C:\Windows\System32\clbcatq.dll
    in GAME SHAS2: e710817b205be4d9f6857c62c2c8db4995ad7d122b8c29552c6cd5ddc55fe78e process: C:\Windows\System32\WLDAP32.dll
    in GAME SHAS2: a2dc3039c8c8618822c2940ead78b9961c6ec25a82375c2a8a41fe1eaa370ac1 process: C:\Windows\system32\hid.dll
    in GAME SHAS2: e832e3a58b542e15a169b1545ce82451ace19bd361fd81764383048528f9b540 process: C:\Windows\System32\crypt32.dll
    in GAME SHAS2: 18de438e2c068383700c5a87423b70b251302f0d5107f331bc7ede5097504907 process: C:\Windows\System32\MSASN1.dll
    in GAME SHAS2: ab620ee31fb65f1a51b2fa28f30bc31329966cb27e3570812138df99e4d7cc8d process: C:\Windows\System32\NSI.dll
    in GAME SHAS2: cad38c9348fca41ffd0c2e4d66a1ff5b7ea16db4928b464aa69b1c166dab039f process: C:\Windows\SYSTEM32\DNSAPI.dll
    in GAME SHAS2: 97ea65eb716f44b8738b0a6ab70d9eb92f7df8540bd76a76e8068e88fb24af8e process: C:\Windows\system32\napinsp.dll
    in GAME SHAS2: 53d6996c37a647ab2da1b8f775484032e9015a22ec3877c748242fd03f2ffe84 process: C:\Windows\system32\pnrpnsp.dll
    in GAME SHAS2: 266a5502d91a16fdad816e8c2bbe002bb33def30047e4058fd09512c87d3a23d process: C:\Windows\System32\mswsock.dll
    in GAME SHAS2: 0ce5de9525699efa35d7378472391be583e3cb160557eb5908fdd5f6a38324f9 process: C:\Windows\System32\winrnr.dll
    in GAME SHAS2: 6687eb1a5c66b1070bc881d3bd0f2cfb39ff692bb91fe98c7f0d896abe07d571 process: C:\Windows\system32\NLAapi.dll
    in GAME SHAS2: 5e6d0f371594b4388c51d5153d7209ef9a8e691e669c6a6499c97ec33b290fd4 process: C:\Windows\system32\wshbth.dll
    in GAME SHAS2: 5e6d0f371594b4388c51d5153d7209ef9a8e691e669c6a6499c97ec33b290fd4 process: C:\Windows\system32\wshbth.dll
    in GAME SHAS2: 3c079bae94e2ce9c252b7cdc2f09a1c7ab6800c76472e27e80f6b1a319031273 process: C:\Windows\SYSTEM32\DEVOBJ.dll
    in GAME SHAS2: 824015564c3da62b29608f6b22f60cfcaf765e5ebf86d2053e6991123d66766d process: C:\Windows\System32\WINTRUST.dll
    in GAME SHAS2: c1fe1acc6dbe60fcc266520ae103b5e3e74c596ed748e3dfc0c5911dfd4c051d process: C:\Windows\System32\imagehlp.dll
    in GAME SHAS2: 49bf93c5c4d0d4aee050ed83193dcf3fcb08d50db5f0b7740436b24b83d14023 process: C:\Windows\system32\rsaenh.dll
    in GAME SHAS2: 85cb2884dcb2e1e93ad04148b0bbffe17d8bcca0bf27e9ac5ba1fe7ae69b1d9a process: C:\Windows\SYSTEM32\gpapi.dll
    FSHAS2: 4ee9d250485e383365fccf6ddec48a03d197f94c40fcf23e13deb4c226df4a79 process: C:\Windows\System32\GameBarPresenceWriter.exe
    SHAS2: 4ee9d250485e383365fccf6ddec48a03d197f94c40fcf23e13deb4c226df4a79 process: C:\Windows\System32\GameBarPresenceWriter.exe
    SHAS2: 2c2e39cac9f06a6ff821e3ad1f6302c8dd17d5971a7cb1260f47bdc7a5bc7861 process: C:\Windows\System32\SearchProtocolHost.exe
    SHAS2: 8165f531d4e6e2827b9f45bfeddb8a7c45e11211d813c70b8243857110b69225 process: C:\Windows\System32\SearchFilterHost.exe
    SHAS2: 4ca1c5838541b319793f964a9b7364f8921dc3b57e6adb713e60ea7c54523422 process: D:\Games\CrossfireWest\CrossFire\awesomium_process.exe

    (Mon 1) DX11(77) : Each 120 at 2020-01-20 17:21:46 file: 003.JPG- Zip CRC: f3af6926757cd43b828b23d905bd9653113ace76df19865e7cec0f117a33ac40
    ping:70ms
    SHAS2: 4ca1c5838541b319793f964a9b7364f8921dc3b57e6adb713e60ea7c54523422 process: D:\Games\CrossfireWest\CrossFire\awesomium_process.exe
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(136) : Each 120 at 2020-01-20 17:24:50 file: 004.JPG- Zip CRC: 7e71b934f7a13130367db34eae058426ab9fec443fb0fbda98ce692ffce1b9aa
    ping:64ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(126) : Each 120 at 2020-01-20 17:27:53 file: 005.JPG- Zip CRC: 0c53000d4eef1d59c11262d43837143a0f987b418e92acef62786b8e35a50298
    ping:78ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(172) : Each 120 at 2020-01-20 17:30:57 file: 006.JPG- Zip CRC: 22f63c44ea1ac8175ad9f85c37af83940b0ae4ef46b8654d96978c40e780b940
    ping:68ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(132) : Each 120 at 2020-01-20 17:31:29 file: 007.JPG- Zip CRC: a51c2a5a9a05b2b9f634e376ce47c89c5b5984240d8677ab841ef42c0abe80b4
    ping:65ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(126) : Each 120 at 2020-01-20 17:32:09 file: 008.JPG- Zip CRC: 79a158de7a19c4ec84dba079f2134ba99858fa967c4fd29d9dfe0415d7674b31
    ping:69ms
    F-
    (Mon 1) DX11(114) : Each 120 at 2020-01-20 17:32:22 file: 009.JPG- Zip CRC: 85ee875e1cd85bb151c661e1f8872fb4fc884e8c93010608140e996966479dbe
    ping:63ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(121) : Each 120 at 2020-01-20 17:35:25 file: 010.JPG- Zip CRC: 3e360d6394ea9582ca01cefc1bf8f2c513a7de49efc0ec532d385afc477b7850
    ping:69ms
    F-
    (Mon 1) DX11(140) : Each 120 at 2020-01-20 17:35:56 file: 011.JPG- Zip CRC: d1825c613a3494c1eac3dc06e57dccaf2a3ebad2e0ce8be336f20bebb6376f81
    ping:71ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(132) : Each 120 at 2020-01-20 17:36:25 file: 012.JPG- Zip CRC: 04d63afff53548ef9de6ce4d229f4f805406b63639c2c4ff569aa890fc550b06
    ping:74ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(127) : Each 120 at 2020-01-20 17:39:29 file: 013.JPG- Zip CRC: 160d853228911a5a754d47468c1f87a4f523321b802e5f9f5e16a731711621e9
    ping:63ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(133) : Each 120 at 2020-01-20 17:40:47 file: 014.JPG- Zip CRC: e6ccda16b06383ddac9a11a2a13635341a657f754236f6109f88278cb0da7bee
    ping:64ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(132) : Each 120 at 2020-01-20 17:43:50 file: 015.JPG- Zip CRC: aca6873560fd975455709647ecc4317e4d7c12bd3dd4b8e1c671fb4cac2abea0
    ping:65ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(129) : Each 120 at 2020-01-20 17:45:52 file: 016.JPG- Zip CRC: 43e2de1ae21260d47a96939f9ff7294edbbd8907ac1de44963d10190ea3c0084
    ping:70ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(134) : Each 120 at 2020-01-20 17:46:11 file: 017.JPG- Zip CRC: bbc2a75abab8b2388d778fde42012ed669bf36f6df31c490d8caac8b2e19f904
    ping:64ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(134) : Each 120 at 2020-01-20 17:48:10 file: 018.JPG- Zip CRC: b4d37ab4f1b9393eb26cd0192a33df6925344705d781bb32257941107b2d46ae
    ping:91ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(128) : Each 120 at 2020-01-20 17:51:13 file: 019.JPG- Zip CRC: 8aad6356499f5a777a3109947204a44866e4407d9b50d18fad66c5d6d2136e80
    ping:64ms
    F-
    (Mon 1) DX11(89) : Each 120 at 2020-01-20 17:51:49 file: 020.JPG- Zip CRC: f2066c8f8a09a73c915604a5e2e74aae8d784a420bd4ec32943dbdf384e4c4f7
    ping:66ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 74b3323405cdfb85cfc9d5c1cd29c816c80361df154801e44f14863c9058906e process: C:\Windows\System32\backgroundTaskHost.exe
    SHAS2: 74b3323405cdfb85cfc9d5c1cd29c816c80361df154801e44f14863c9058906e process: C:\Windows\System32\backgroundTaskHost.exe
    SHAS2: 2c2e39cac9f06a6ff821e3ad1f6302c8dd17d5971a7cb1260f47bdc7a5bc7861 process: C:\Windows\System32\SearchProtocolHost.exe
    SHAS2: 2c2e39cac9f06a6ff821e3ad1f6302c8dd17d5971a7cb1260f47bdc7a5bc7861 process: C:\Windows\System32\SearchProtocolHost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(82) : Each 120 at 2020-01-20 17:53:39 file: 021.JPG- Zip CRC: 9c6a1b4051fe7a8f5f5a3964e56d290ef762360470d9b84d87dd69890b9728d7
    ping:63ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(82) : Each 120 at 2020-01-20 17:55:22 file: 022.JPG- Zip CRC: ae502a6fff166de3cd44fc95a993233f2bfc3e0546068c29103e86a3ccbcf5e8
    ping:64ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 2c2e39cac9f06a6ff821e3ad1f6302c8dd17d5971a7cb1260f47bdc7a5bc7861 process: C:\Windows\System32\SearchProtocolHost.exe
    SHAS2: 8165f531d4e6e2827b9f45bfeddb8a7c45e11211d813c70b8243857110b69225 process: C:\Windows\System32\SearchFilterHost.exe
    SHAS2: 8165f531d4e6e2827b9f45bfeddb8a7c45e11211d813c70b8243857110b69225 process: C:\Windows\System32\SearchFilterHost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(123) : Each 120 at 2020-01-20 17:57:46 file: 023.JPG- Zip CRC: 218880751e75684289ee2c0fa23b556847f8d7716ef2ed64ba0152cf2e7f9f45
    ping:63ms
    SHAS2: 0a863c068a07b5b5c51d28dcfc3ac6fc209c73bec67cceafd47b98c72392383c process: C:\Program Files\Microsoft Office\root\Office16\msoia.exe
    SHAS2: 0a863c068a07b5b5c51d28dcfc3ac6fc209c73bec67cceafd47b98c72392383c process: C:\Program Files\Microsoft Office\root\Office16\msoia.exe
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(164) : Each 120 at 2020-01-20 18:00:49 file: 024.JPG- Zip CRC: 477c766808841dd7a7555413f6dab94cfafb0baa7f190372baf2506ab3fb3378
    ping:65ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(93) : Each 120 at 2020-01-20 18:01:38 file: 025.JPG- Zip CRC: f17399b44b3fcc6d120fa6aead4dd0bd0900a785708ac696d52bdcd7ff331c2d
    ping:71ms
    F-
    (Mon 1) DX11(118) : Each 120 at 2020-01-20 18:01:58 file: 026.JPG- Zip CRC: 7a9fd240729a4398bac5e8f4e33c3246778850a6a42abea39871d4d1ee5b2006
    ping:66ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(114) : Each 120 at 2020-01-20 18:02:26 file: 027.JPG- Zip CRC: 16eca3974d20123aa4352690ed8a183a7088a3d5a0173aad0baf343297a01942
    ping:76ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(132) : Each 120 at 2020-01-20 18:04:17 file: 028.JPG- Zip CRC: 7baa26c78e2ca08b53b7b20322c23072822fd8f4c7864fecb87aaa66967912bb
    ping:69ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(128) : Each 120 at 2020-01-20 18:06:15 file: 029.JPG- Zip CRC: 9cb175900298abcec992b533a4df8e49ff01f439a32af38aac35145102071bde
    ping:68ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(133) : Each 120 at 2020-01-20 18:09:20 file: 030.JPG- Zip CRC: 7e10eef53a31f12eb5983efd829d4e276aac7271013724aeaae045323039017e
    ping:62ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(125) : Each 120 at 2020-01-20 18:12:14 file: 031.JPG- Zip CRC: 15daa49c8ae1fcf820ece0bccd280901bb39ce0078c338b5aa2f31d7cad7a720
    ping:66ms
    F-
    (Mon 1) DX11(96) : Each 120 at 2020-01-20 18:12:44 file: 032.JPG- Zip CRC: d47e1c9c89238847ab66854e266758bbd30d92f9a6e97989ee55d221445ca012
    ping:69ms
    F-
    (Mon 1) DX11(112) : Each 120 at 2020-01-20 18:12:58 file: 033.JPG- Zip CRC: 67a9eaff5e00157d46fcc2cc0f90ae64492baf1373aece6270aaee4b5eeb2bf0
    ping:64ms
    FSHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe

    (Mon 1) DX11(126) : Each 120 at 2020-01-20 18:15:22 file: 034.JPG- Zip CRC: c4f2d6fc5097cdbd5fbfac1f2bffd33dbbedfd06409f2006e0f2de84499bfd5c
    ping:71ms
    FSHAS2: 8165f531d4e6e2827b9f45bfeddb8a7c45e11211d813c70b8243857110b69225 process: C:\Windows\System32\SearchFilterHost.exe
    SHAS2: 8165f531d4e6e2827b9f45bfeddb8a7c45e11211d813c70b8243857110b69225 process: C:\Windows\System32\SearchFilterHost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: 96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b72 process: C:\Windows\System32\wbem\WMIC.exe
    SHAS2: baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b69 process: C:\Windows\System32\conhost.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    SHAS2: 5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77 process: C:\Windows\System32\RuntimeBroker.exe
    (Mon 1) DX11(66) : Each 120 at 2020-01-20 18:17:30 file: 035.JPG- Zip CRC: 7338ba2d88457f44eabb594eb8112872a0f77011308434fa73640513db98f75b
    ping:66ms

    Monitor stoppped at 2020-01-20 18:17:28
    ping:71ms

    Processes statistics ping:71
    PID Running Time Kernel Time User Time Name
    824 02:00:56:02 00:00:07 00:00:10 lsass.exe
    88 02:00:56:02 00:00:01 00:00:00 fontdrvhost.exe
    1812 02:00:56:02 00:00:00 00:00:02 NVDisplay.Container.exe
    1860 02:00:56:02 00:00:00 00:00:00 igfxCUIService.exe
    3236 02:00:56:02 00:00:00 00:00:00 spoolsv.exe
    3544 02:00:56:01 00:00:00 00:00:00 dashost.exe
    3552 02:00:56:01 00:00:00 00:00:00 IntelCpHDCPSvc.exe
    3576 02:00:56:01 00:00:00 00:00:01 OfficeClickToRun.exe
    3728 02:00:56:01 00:00:03 00:00:02 ServiceHost.exe
    3816 02:00:56:01 00:00:00 00:00:01 nvcontainer.exe
    3848 02:00:56:01 00:00:00 00:00:00 NvTelemetryContainer.exe
    3876 02:00:56:01 00:00:00 00:00:00 RtkAudUService64.exe
    3916 02:00:56:01 00:00:00 00:00:00 WavesSysSvc64.exe
    4404 02:00:56:01 00:00:00 00:00:00 IntelCpHeciSvc.exe
    1872 02:00:56:00 00:03:59 00:03:02 wmiprvse.exe
    6344 02:00:55:57 00:00:02 00:00:00 wmiprvse.exe
    6800 02:00:55:56 00:00:00 00:00:00 PresentationFontCache.exe
    7868 02:00:55:51 00:00:00 00:00:00 DllHost.exe
    8200 02:00:55:48 00:00:09 00:00:22 SearchIndexer.exe
    9548 02:00:55:33 00:00:00 00:00:00 GoogleCrashHandler.exe
    9948 02:00:55:28 00:00:00 00:00:00 GoogleCrashHandler64.exe
    5700 02:00:54:01 00:00:00 00:00:00 jhi_service.exe
    7136 02:00:54:01 00:00:00 00:00:00 LMS.exe
    7408 01:00:34:48 00:00:00 00:00:00 WinLogon.exe
    1724 01:00:34:48 00:00:00 00:00:00 fontdrvhost.exe
    8092 01:00:34:47 00:19:18 00:43:23 dwm.exe
    3216 01:00:34:41 00:00:09 00:00:03 NVDisplay.Container.exe
    8632 00:12:49:47 00:00:00 00:00:00 UIHost.exe
    13288 00:12:49:47 00:00:00 00:00:00 RtkAudUService64.exe
    8680 00:12:49:47 00:00:07 00:00:04 ctfmon.exe
    12656 00:12:49:47 00:00:02 00:00:02 nvcontainer.exe
    2448 00:12:49:47 00:00:01 00:00:01 sihost.exe
    1348 00:12:49:47 00:00:00 00:00:00 unsecapp.exe
    10464 00:12:49:46 00:00:00 00:00:00 taskhostw.exe
    6192 00:12:49:46 00:00:03 00:00:01 igfxEM.exe
    7000 00:12:49:42 00:01:01 00:00:34 Explorer.EXE
    10264 00:12:49:38 00:00:01 00:00:02 StartMenuExperienceHost.exe
    7288 00:12:49:36 00:00:00 00:00:00 RuntimeBroker.exe
    2636 00:12:49:36 00:00:01 00:00:03 SearchUI.exe
    8732 00:12:49:34 00:00:00 00:00:00 RuntimeBroker.exe
    8060 00:12:49:33 00:00:00 00:00:00 SkypeApp.exe
    6624 00:12:49:33 00:00:00 00:00:00 SkypeBackgroundHost.exe
    6080 00:12:49:33 00:00:00 00:00:00 YourPhone.exe
    8052 00:12:49:27 00:00:00 00:00:00 RuntimeBroker.exe
    9468 00:12:49:21 00:00:00 00:00:00 RuntimeBroker.exe
    8476 00:12:49:21 00:00:01 00:00:02 OneDrive.exe
    6656 00:12:49:15 00:00:02 00:00:01 IEMonitor.exe
    9332 00:12:49:00 00:00:00 00:00:00 RuntimeBroker.exe
    10228 00:12:48:26 00:00:00 00:00:00 WinStore.App.exe
    2036 00:12:48:26 00:00:01 00:00:01 ApplicationFrameHost.exe
    5808 00:12:48:24 00:00:00 00:00:00 RuntimeBroker.exe
    8628 00:12:47:45 00:00:00 00:00:00 NVIDIA Web Helper.exe
    9504 00:12:47:45 00:00:00 00:00:00 conhost.exe
    6872 00:12:43:03 00:00:00 00:00:00 rundll32.exe
    3960 00:12:42:56 00:00:00 00:00:01 ShellExperienceHost.exe
    11664 00:12:42:56 00:00:00 00:00:00 RuntimeBroker.exe
    13148 00:12:42:51 00:00:00 00:00:00 DllHost.exe
    9464 00:06:59:05 00:00:00 00:00:00 Music.UI.exe
    13100 00:03:09:34 00:00:09 00:00:15 GameBar.exe
    12200 00:03:09:34 00:00:00 00:00:00 RuntimeBroker.exe
    13092 00:03:09:33 00:00:00 00:00:00 GameBarFT.exe
    3184 00:01:28:14 00:00:00 00:00:00 Microsoft.Photos.exe
    9298 keystroke, 241 Patterns found

    sequence [A] [S] : interval distribution
    ^ 67 events
    9 | X
    8 | X X
    7 | X X X
    6 | X X X X
    5 | X X X X
    4 | X X X X X
    3 | X X X X X XX X X X
    2 | X X X XX X XX X X XX X X X
    1 | X X XX XX XX XX XX XX XX XX X X XX
    0 | X X XX XX XX XX XX XX XX XX X X XX
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [LEFT CLICK] [LEFT CLICK] : interval distribution
    ^ 57 events
    8 | X X X
    7 | X X XX
    6 | X XX X XX
    5 | X XX XX XX
    4 | X X XX XX XX
    4 | X X XX XX XX
    3 | X X XX XX XX
    2 | X X XX XX XX
    1 | XX X XX XX XX XXX
    0 | XX X XX XX XX XXX
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [D] [S] : interval distribution
    ^ 89 events
    11 | X
    9 | X
    8 | X X
    7 | X X X X
    6 | X X X X X
    5 | X X X X X X X
    4 | X X X X X X X
    3 | X X X X XX X X X X X
    2 | X X X X X XX X X XXXX X X X X X
    1 | X X XX X X X XX X X XX XXX XX X XXXXX XX X X XX X
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [D] [W] : interval distribution
    ^ 80 events
    9 | X
    8 | X
    7 | X
    6 | X X
    5 | X X X X X
    4 | X X X X X X X XX X
    3 | X X X X X X X XX XX X X
    2 | X X X X XX X XX XX XX XX XX X X
    1 | X X X X X XX XX XX XX XX X XXXX XX XX XX X
    0 | X X X X X XX XX XX XX XX X XXXX XX XX XX X
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [W] [A] : interval distribution
    ^ 69 events
    8 | X
    7 | X
    6 | X X
    5 | X X X
    4 | X X X X X XX X
    4 | X X X X X XX X
    3 | X X X X X XX X XX XX
    2 | X X X X XX X X X XX X XX XX
    1 | X X X XX XX X XX X X XX X XXX XX XXX XX
    0 | X X X XX XX X XX X X XX X XXX XX XXX XX
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [A] [SPACE] : interval distribution
    ^ 48 events
    5 | X X
    4 | X X XX
    4 | X X XX
    3 | X XX X XX
    3 | X XX X XX
    2 | XX X X XX X XX
    2 | XX X X XX X XX
    1 | XX X X X XX X X XX X X XX XX XXX X X X XX X
    1 | XX X X X XX X X XX X X XX XX XXX X X X XX X
    0 | XX X X X XX X X XX X X XX XX XXX X X X XX X
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [A] [W] : interval distribution
    ^ 65 events
    8 | X X
    7 | X X
    6 | X X X
    5 | X X X
    4 | X X XX X
    4 | X X XX X
    3 | X X X X XX XX
    2 | X X X X X X XX XX X X X
    1 | XX X X XXX X X X XX X XXXXX X XX XX XX XX X
    0 | XX X X XXX X X X XX X XXXXX X XX XX XX XX X
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [W] [D] : interval distribution
    ^ 60 events
    7 | X
    6 | X
    5 | X
    4 | X X X
    4 | X X X
    3 | X X X XX XX XX
    2 | X X X XX X X XX XX X XX XX
    2 | X X X XX X X XX XX X XX XX
    1 | X X X X XX X XX XX XX X XXX X XX XX X XX XX X
    0 | X X X X XX X XX XX XX X XXX X XX XX X XX XX X
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [A] [D] : interval distribution
    ^ 272 events
    40 | X
    36 | X
    32 | X X
    28 | X X
    24 | XX XX
    20 | X XX X XX
    16 | X XX XX XX
    12 | X XX XX XX
    8 | X XX XX XX XX
    4 | X X XX XX X XX XX XX XX
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [D] [A] : interval distribution
    ^ 358 events
    66 | X
    59 | X
    52 | X
    46 | X
    39 | X
    33 | X X
    26 | X X X
    19 | X XX X X
    13 | X X XX XX X X X
    6 | XX XX X X XX XX XX XX XX
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [S] [A] : interval distribution
    ^ 55 events
    8 | X
    7 | X X X
    6 | X X X
    5 | X X X X X
    4 | X X X X X X
    4 | X X X X X X
    3 | X X X X X X X
    2 | X X X X X X X XX XX
    1 | X XXX XX X X X XX X XX X X XX
    0 | X XXX XX X X X XX X XX X X XX
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [RIGHT CLICK] [LEFT CLICK] : interval distribution
    ^ 57 events
    9 | X
    8 | X X
    7 | X X X
    6 | X X X
    5 | X X X X
    4 | X X X X X X
    3 | X X X X X X X X X
    2 | X X X X X XX X XX X X
    1 | X XX X X X X XX X XX X X XX
    0 | X XX X X X X XX X XX X X XX
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [D] [SPACE] : interval distribution
    ^ 47 events
    5 | X
    4 | X X X X
    4 | X X X X
    3 | X X X X X
    3 | X X X X X
    2 | XX X X X X X X X XX
    2 | XX X X X X X X X XX
    1 | XX X X X X X X XX XX XXXXX XX X X X XX X
    1 | XX X X X X X X XX XX XXXXX XX X X X XX X
    0 | XX X X X X X X XX XX XXXXX XX X X X XX X
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900

    sequence [A] [BACK] : interval distribution
    ^ 46 events
    6 | X
    5 | X X
    4 | X X X
    4 | X X X
    3 | XX X X X
    3 | XX X X X
    2 | X XX XXX XX XXXX
    1 | X XX X X XXX XXXX XXXXXX XXXX
    1 | X XX X X XXX XXXX XXXXXX XXXX
    0 | X XX X X XXX XXXX XXXXXX XXXX
    ———————————————————————————————————————————————-> 140 ms
    0100000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999111111111111111111111111111111111111111111
    0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789000000000011111111112222222222333333333334
    012345678901234567890123456789012345678900
    Global log CRC: 2a8b22eac145de2ad781e89d263671bc8338304afdbd63a228019f4bd83ddbdb

    #5102
    ADM_nohope
    Keymaster

    do you have the original zip ?

    #5104
    mosscheck90
    Participant

    Sure here is it : https://easyupload.io/hca3a7

    #5137
    mosscheck90
    Participant

    uploaded on another site : https://ufile.io/5qdt5733

    #5165
    moetaz11
    Participant

    bumping this as the moss files captured doesnt display anything suspicious contradicting the recording which shows a sort of aim assist/bot/trigger of some sort and blatant menu toggling

    • This reply was modified 9 months ago by moetaz11.
Viewing 5 posts - 1 through 5 (of 5 total)
  • You must be logged in to reply to this topic.

Play Cool , Play Hard but Play Fair